APP MANAGER
User Manual
v2.5.24
April 3, 2021
Copyright ©2020–2021 Muntashir Al-Islam
“Wisely and slow. They stumble that run fast.” — Friar Laurence, Romeo and Juliet
Chapter 1
Introduction
App Manager is an advanced package manager for Android. It offers many features and consequently, it requires a user manual to assist its users with features that it offers. This document acts as a user manual for App Manager in the sense that it contains the description of every feature that App Manager has to offer. The document can be considered as the “official” guidelines for App Manager and represent the expected behaviour of App Manager. Translations can misinterpret this document (which is written in English). Therefore, it is recommended that you read the English version if possible. There might be other unofficial or third-party resources such as blog articles, videos, chat groups, etc. While these resources might be useful for many people, they may not be up-to-date. In case any deviations are detected in App Manager from this document, they should be reported in the App Manager issue tracker.
1.1 Terminologies
- AM — Short name for App Manager
- AoT — Short form of ADB over TCP
- Block/Unblock — Used for component blocking. It denotes that a component is blocked using Intent Firewall and disabled using PackageManager.
- IFW — Short form of Intent Firewall.
- Ops — Short name for operations, e.g. app ops, batch ops, 1-click ops
- SSAID — Short form of Settings.Secure.ANDROID_ID. It is a device identifier assigned to each app (from Android Oreo and onwards). It is generated from the combination of the signing certificate of the app and the SSAID set for the package android. As a result, it is guaranteed to be the same for an app unless the user formats the device. It is widely used for tracking users.
- Tracker — Denotes tracker components throughout the document and in App Manager except the scanner page. Trackers include libraries such as crash reporters, analytics, profiling, identification, ads, location, etc. Thus, they are not equal in functions. There is no distinction or bias between open source and closed source libraries.
1.2 Supported Versions
Currently supported versions are v2.5.20 (stable), v2.5.23 (pre-release) and v2.5.24 (debug release).
1.3 Official Sources
1.3.1 Binary Distribution Sources
App Manager is distributed using the following sources. Unofficial sources may distribute modified versions of App Manager, and none but you shall be responsible for the consequences of using such distributions.
- Official F-Droid repository.1
Link: https://f-droid.org/packages/io.github.muntashirakon.AppManager - IzzyOnDroid repository for F-Droid.2
Link: https://apt.izzysoft.de/fdroid/index/apk/io.github.muntashirakon.AppManager - GitHub repository.
Normal releases: https://github.com/MuntashirAkon/AppManager/releases
Debug releases: https://github.com/MuntashirAkon/AppManager/actions - Telegram.
Normal releases: https://t.me/AppManagerChannel
Debug releases: https://t.me/AppManagerDebug
1.3.2 Links to Source Code
All but GitHub are the mirror links. The tags should always be up-to-date, but the master branch is not guaranteed to be up-to-date. If the target is to clone the master branch, use the GitHub link instead of the others.
- GitHub: https://github.com/MuntashirAkon/AppManager
- GitLab: https://gitlab.com/muntashir/AppManager
- Codeberg: https://codeberg.org/muntashir/AppManager
- Riseup: https://0xacab.org/muntashir/AppManager
1.3.3 Translations
Horizontal Action Panel, as described in the previous section, consists of various app-related actions, such as–
- Launch. Application that has a launcher activities can be launched using this button.
- Uninstall. Uninstall an app.
1.4 Contributing
There are multiple ways a user can contribute such as creating helpful issues, attending discussions, improving documentations and translations, adding unrecognised libraries or trackers, reviewing the source code as well as reporting security vulnerabilities.
1.4.1 Build Instructions
Build instructions are available in the README file of the root directory of the source.
1.4.2 Submitting patches
Repositories located in sites other than GitHub are currently considered mirrors and pull/merge requests submitted there will not be accepted. Instead, patches (as .patch files) can be submitted via email attachments. Make sure to sign-off your commits.
Info. GitHub PRs will be merged manually using the corresponding patches. As a result, GitHub may falsely mark them closed instead of merged.
Notice. In case of submitting patches via email, the whole conversation may be publicly accessible in the future. So, do not include any personally identifiable information (PII) other than your name or email address.
1.5 Donation & Funding
Donation or purchase is not a requirement in order to use App Manager. While App Manager does not support any purchases, donations can be sent to the author of App Manager using one of the following Bitcoin addresses as a tribute:
38bzvWDD99dJhXg9tC4yQEnGdnAKPtwSXG
3FHTxPoYa92dNJK6pkhwyVkMG8Vv3VpGpg
By sending BTC, the sender agrees that he/she/they shall not make the transaction information public i.e. the transaction will remain anonymous, nor shall he/she/they use it as a leverage to prioritise his/her/their requested features. Feature requests do not require any bounties or donations, and they are prioritised according to the authors’ preferences.
App Manager is open for funding/grants. Representatives of the interested organizations can contact the author directly using the options given in §1.6.
1.6 Contact
By default, Termux does not allow running commands from third-party applications. To enable this option, you have to add allow-external-apps=true in ~/.termux/termux.properties, and make sure that you are running Termux v0.96 or later.
Chapter 2
Pages
2.1 Main Page
Main page lists all the installed apps (or a list of apps supplied by any third-party application) as well as apps that has existing backups. A single click on any installed app item opens the respective App Details page. Using the sort option from the menu, the app items can be sorted in various ways and preserved on close. It is also possible to filter items based on your needs using the filter option in the menu. You can filter using more than one options. You can also filter apps using app labels or package name using the search button.
2.1.1 Batch Operations
Batch operations or operation on multiple apps are also available within this page (most these operations require root or ADB over TCP). To enable multiple selection mode, click on any app icon or long click on any app. After that, you can use the regular click to select apps instead of opening the App Details page. These operations include:
- Backup APK file (no root)
- Backup/restore/delete app data
- Clear data from apps
- Enable/disable/force-stop/uninstall apps
- Disable run in background
- Block ad and tracker components
- Export blocking rules
- Add the selected apps to a profile
2.1.2 Colour Codes
Here’s the list of colours used in this page, and their meaning:
- Light greyish orange (day) / dark blue (night) – App selected for batch operation
- Light red (day) / dark red (night) – Disabled app
- Yellow Star – App is in debug mode
- Orange Date – App can read logs (permission granted)
- Orange UID – User ID is being shared between apps
- Orange SDK – Uses cleartext (ie. HTTP) traffic
- Red package name – App does not allow clearing data
- Red backup – App not installed but has one or more backups
- Dark cyan package name – Stopped or forced closed app
- Dark cyan version – Inactive app
- Magenta – Persistent app i.e. remains running all the time
2.1.3 Application Types
An app is either User App or System App along with the following codes:
- X – The app supports multiple architectures: 32-bit, 64-bit or arm-v7, arm-v8, etc.
- 0 – App does not have code with it
- ° – App is in suspended state
- # – App has requested a large heap
- ? – App has requested VM in safe mode
2.1.4 Version Info
App Ops stands for Application Operations. Since Android 4.3, App Ops are used by Android system to control most of the application permissions. Each app op has a unique number associated with them which are closed inside first brackets in the App Ops tab. They also have private and optionally a public name. Some app ops are associated with permissions as well. The dangerousness of an app op is decided based on the associated permission, and other informations such as flags, permission name, permission description, package name, group are taken from the associated permission. Other information may include the following:
- Mode. It describes the current authorisation status which can be allow, deny (a rather misnomer, it simply means error), ignore (it actually means deny), default (inferred from a list of defaults set internally by the vendor), foreground (in newer Androids, it means the app op can only be used when the app is running in foreground), and some custom modes set by the vendors (MIUI uses ask and other modes with just numbers without any associated names).
- Duration. The amount of time this app op has been used (there can be negative durations whose use cases are currently not known to me).
- Accept Time. Last time the app op was accepted.
2.1.5 Options Menu
Options menu has several options which can be used to sort, filter the listed apps as well as navigate to different pages.
2.1.5.1 Instructions
Clicking on instructions open an offline version of the App Manager documentations. It opens the online version if the corresponding feature split i.e. feat_docs is not installed.
2.1.5.2 List Options
See also: Appendix: App Ops
Sort Apps listed on the main page can be sorted in different ways. The sorting preference is preserved which means the apps will be sorted the same way that was sorted in the previous launch. Regardless of your sorting preference, however, the apps are first sorted alphabetically to prevent random results.
- User app first. User apps are listed on top
- App label. Sort in ascending order based on the app labels (also known as app names). This is the default sorting preference
- Package name. Sort in ascending order based on package names
- Last update. Sort in descending order based on the package update date (or install date if it is a newly installed package)
- Shared user ID. Sort in descending order based on the kernel user ID
- Target SDK. Sort in ascending order based on the target SDK
- Signature. Sort in ascending order based on app’s signing info
- Disabled first. List disabled apps first
- Blocked first. Sort in descending order based on the number of blocked components
- Backup first. Display apps with backups on top
There is also a reverse option which can be used to sort the apps in reverse order.
Filter Apps listed on the main page can be filtered in a number of ways. Like sorting, filtering preferences are also stored and retained after a relaunch.
- User apps. List only the user apps
- Name. Each permission has a unique name like android.permission.INTERNET but multiple app can request the permission.
- Icon. Each permission can have a custom icon. The other permission tabs do not have any icon because they do not contain any icon in the app manifest.
- Description. This optional field describes the permission. If there isn’t any description associated with the permission, the field is not displayed.
- Flags. (Uses the flag symbol or Protection Level name) This describes various permission flags such as normal, development, dangerous, instant, granted, revoked, signature, privileged, etc.
- Package Name. Denotes the package name associated with the permission, i.e. the package that defined the permission.
- Group. The group name associated with the permission (if any). Newer Androids do not seem to use group names which is why you’ll usually see android.permission-group.UNDEFINED or no group name at all.
- Running apps. List apps that are currently running (either in foreground or background)
- Apps with splits. List apps with one or more split APKs
- Installed apps. List only installed apps
- Uninstalled apps. List only uninstalled apps including backups
Unlike sorting, you can filter using more than one option. For example, you can list the disabled user apps by filtering app lists selecting user apps and disabled apps. This is particularly useful for batch operations where you can filter all user apps to carry out certain operations.
2.1.5.3 Операции в один клик
Операции в один клик. Вы можете напрямую открыть Операции в один клик. , нажав на эту опцию.
2.1.5.4 Использование приложений
Статистика использования приложения, например время работы экрана, использование данных (мобильные и Wifi), количество запусков можно получить, нажав на опцию использование приложений в меню (требует предоставление разрешения на доступ к истории использования .
2.1.5.5 Конфигурация системы
Отображает различные системные настройки и белые списки/черные списки, включенные в Android либо OEM/поставщиком, AOSP или даже некоторые модули Magisk.
2.1.5.6 Работающие приложения
Список работающих приложений или процессов можно просмотреть, нажав на опцию работающие приложения в меню (требует root или ADB). Работающие приложения или процессы также могут быть принудительно остановлены или закрыты на странице результата.
2.1.5.7 APK Updater
Если у вас установлено приложение APK Updater вы можете использовать соответствующую опцию в меню, чтобы напрямую открыть это приложение. Параметр скрыт, если у вас не установлено это приложение.
2.1.5.8 Профили
Открывает страницу профилей. Профили - это способ настраивать часто используемые задачи. Вы также можете добавить ярлыки профилей в лаунчер для их непосредственного запуска.
2.1.5.9 Termux
Если у вас установлен Termux, вы можете сразу перейти к текущему сеансу или открыть новый сеанс, используя опцию Termux в меню.
2.1.5.10 Настройки
Вы можете перейти в настройки нажатием на соответствующую опцию в правом верхнем углу.
2.2 Страница «Сведения о приложении»
Страница «Сведения о приложении» состоит из 11 (одиннадцати) вкладок. В основном она описывает почти каждый бит информации, которую может иметь приложение, включая все атрибуты из манифеста приложения, разрешения, операции приложения, информацию о подписи и т. д.
2.2.1 Цветовые коды
Список фоновых цветов, используемых на этой странице, и их значение:
- Красный (светлая тема) / темно-красный (темная тема) – любая операция приложения или разрешение приложения, имеющие опасный флаг, помечаются красным. Компоненты, заблокированные в App Manager, также помечаются красным
- Светло-красный (светлая тема) / очень темно-красный (темная тема) – компоненты, отключенные вне App Manager, имеют эти цвета. Следует отметить, что компонент, отмеченный как отключенный, не всегда означает, что он отключен пользователем: он также может быть отключен системой или отмечен как отключенный в манифесте приложения. Кроме того, все компоненты отключенного приложения считаются отключенными системой (а также с помощью App Manager)
- Ярко-оранжевый (светлая тема) / очень темно-оранжевый (темная тема) – компоненты трекера или рекламы
- Мягкий пурпурный (светлая тема) / очень темно-фиолетовый (темная тема) – службы, работающие в настоящее время
2.2.2 Вкладка «О приложении»
Вкладка «О приложении» содержит общую информацию о приложении. В ней также перечислены многие действия, которые могут быть выполнены на этой вкладке. Полное описание приводится ниже:
2.2.2.1 Общая информация
Список ниже находится в том же порядке, что и во вкладке «О приложении».
- Значок приложения. Если приложение не имеет значка, отображается значок системы по умолчанию.
- Метка приложения. Метка приложения или название приложения
- Версия. Версия приложения разделена на две части. Первая часть называется название версии название версии, формат этой части варьируется, но часто он состоит из нескольких целых чисел, разделенных точками. Вторая часть называется код версии и он закрыт первыми скобками. Код версии – это целое число, которое обычно используется для различения версий приложения (поскольку имя версии часто может быть нечитаемым компьютером). Как правило, новая версия приложения имеет более высокий код версии, чем старая. Например, если 123 и 125 это два кода версии приложения, мы можем сказать, что последний новее, чем первый, потому что код версии последнего выше. Для приложений, зависящих от платформ (мобильные устройства, вкладки, настольные компьютеры и т. д.), эти номера версий могут вводить в заблуждение, поскольку они используют префиксы для каждой платформы.
- Теги. (также известные как облака тегов ) Теги включают в себя основную, краткую и наиболее полезную информацию о приложении. Теги содержат следующую информацию: информация о трекерах (т.е. количество трекеров), тип приложения (пользовательское приложение или системное приложение, а также то, является ли приложение обновленной версией системного приложения или если приложение установлено внесистемно с помощью Magisk), работающее (т.е. одна или несколько служб приложения работают в фоновом режиме), сведения об разделенном APK (т.е. количество частей (сплитов)), отладка (является ли приложение отладочной версией), только тест (является ли приложение тестовым), большая куча (запрашивает ли приложение большой размер кучи), остановлено (остановлено ли приложение), отключено (отключено ли приложение), Хранилище ключей (в приложении есть элементы хранилища ключей Android) и нет кода (содержит ли приложение код, связанный с ним). Важным для включения тегов только тест и отладка является то, может ли приложение с этими свойствами выполнять дополнительные задачи или эти приложения могут быть запущены без root, что может вызвать потенциальные проблемы с безопасностью, если эти приложения хранят какую-либо личную информацию. Большая куча означает, что приложению при необходимости будет выделен больший объем памяти (ОЗУ). Хотя это может не нанести вреда для большинства случаев, подозрительные приложения, запрашивающие большую кучу, должны восприниматься серьезно.
- Горизонтальная панель действий. это панель действий, содержащая различные действия в приложении. Смотрите §2.2.2.2 полный список доступных действий.
- Paths & Directories. Contains various information regarding application paths including app directory (where the APK files are stored), data directories (internal, device protected and externals), split APK directories (along with the split names), and native JNI library (if present). JNI libraries are used to invoke native codes usually written in C/C++. Use of native library can make the app run faster or help an app use third-party libraries written using languages other than Java like in most games. You can also open these directories using your favourite file managers (provided they support it and have necessary permissions) by clicking on the launch icon on the right-hand side of each item.
- Data Usage Since Last Boot. A rather self explanatory option. But beware that due to some issues, the results might often be misleading and simply wrong. This part remains hidden if Usage Access permission is not granted in newer devices.
- Storage & Cache. Displays information regarding the size of the app (APK files), data and cache. In older devices, size of external data, cache, media and OBB folders are also displayed. This part remains hidden if Usage Access permission is not granted in newer devices.
- More Info. Displays other information such as–
- SDK. Displays information related to the Android SDK. There are two (one in old devices) values: Max denotes the target SDK and Min denotes the minimum SDK (the latter is not available in old devices). It is best practice to use apps with maximum SDK that the platform currently supports. SDK is also known as API Level. See also: Android Version History
- Flags. The application flags used at the time of building the app. For a complete list of flags and what they do, visit the official documentation.
- Date Installed. The date when the app was first installed.
- Date Updated. The date when the app was last updated. This is the same as Date Installed if the app hasn’t been updated.
- Installer App. The app that installed this app. Not all app supply the information used by the package manager to register the installer app. Therefore, this value should not be taken for granted.
- User ID. The unique user ID set by the Android system to the app. For shared applications, same user ID is assigned to multiple applications that have the same Shared User ID.
- Shared User ID. Applicable for applications that are shared together. Although it says ID, this is actually a string value. The shared application must have the same signatures.
- Main Activity. The main entry point to the app. This is only visible if the app has activities and any of those are openable from the Launcher. There’s also a launch button on the right-hand side which can be used to launch this activity.
2.2.2.2 Horizontal Action Panel
Horizontal Action Panel, as described in the previous section, consists of various app-related actions, such as–
- Launch. Application that has a launcher activities can be launched using this button.
- Disable. Disable an app. This button is not displayed for already disabled apps or to users who do not have root or ADB. If you disable an app, the app will not be displayed in your Launcher app. Shortcuts for the app will also be removed. If you disable a user app, you can only enable them via App Manager or any other tool that supports it. There isn’t any option in Android Settings to enable a disabled user app.
- Uninstall. Uninstall an app.
- Enable. Enable an app. This button is not displayed for already enabled apps or to users who do not have root or ADB.
- Force Stop. Force-stop an app. When you force stop an app, the app will not be able to run in background unless you explicitly open it first. However, this is not always true.
- Clear Data. Clear data from an app. This includes any information stored in the internal and often the external directories, including accounts (if set by the app), cache, etc. Clearing data from App Manager, for example, removes all the rules (the blocking is not removed though) saved within the app. Which is why you should always take backups of your rules. This button is not displayed to users who do not have root or ADB.
- Clear Cache. Clear app cache only. There is not any Android-way to clear app cache. Therefore, it needs root permission to clear cache from the app’s internal storage.
- Install. Install an APK opened using any third-party app. This button is only displayed for an external APK that hasn’t been installed.
- What’s New. This button is displayed for an APK that has higher version code than the installed one. Clicking on this button displays a dialog consisting of differences in a version control manner. The information it displays include version, trackers, permissions, components, signatures (checksum changes), features, shared libraries and SDK.
- Update. Displayed for an app that has a higher version code than the installed app.
- Reinstall. Displayed for an app that has the same version code as the installed app.
- Downgrade. Displayed for an app that has a lower version code than the installed app.
- Manifest. Clicking on this button displays the app’s manifest file in a separate page. The manifest file can be wrapped or unwrapped using the corresponding toggle button (on the top-right side) or can be saved to you shared storage using the save button.
- Scanner. Clicking on this button displays the app’s tracker and library information. At first, it scans the app to extract a list of classes. Then the class list is matched with a number of signatures. After that, a scan summary is displayed.
See also: Scanner page - Shared Prefs. Clicking on this button displays a list of shared preferences used by the app. Clicking on a preference item in the list opens the Shared Preferences Editor page. This option is only visible to the root users.
- Databases. Clicking on this button displays a list of databases used by the app. This needs more improvements, and a database editor which might be added in the future. This option is only visible to the root users.
- F-Droid. Opens the app in your favourite F-Droid client.
- Store. Opens the app in Aurora Store. The option is only visible if Aurora Store is installed.
2.2.2.3 Options Menu
Options-menu is located in the top-right corner of the page. A complete description of the options present there are given below:
- Share. Share button can be used to share the APK file or APKS file (if the app is has multiple splits) can be imported into SAI. You can share it with your favourite file manager to save the file in your shared storage.
- Refresh. Refreshes the App Info tab.
- View in Settings. Opens the app in Android Settings.
- Backup/Restore. Opens the backup/restore dialog.
- Export Blocking Rules. Export rules configured for this app within App Manager.
- Backup options. Same as the backup options of the backup/restore feature. If not set, the default options will be used.
- Run in Termux. Open the app using run-as package_name in Termux. This is only applicable for the debuggable apps and works for both root and ADB users. See §2.2.2.4 to learn how to configure Termux to run commands from third-party applications.
- Extract Icon. Extract and save the app’s icon in your desired location.
2.2.2.4 Termux
By default, Termux does not allow running commands from third-party applications. To enable this option, you have to add allow-external-apps=true in ~/.termux/termux.properties, and make sure that you are running Termux v0.96 or later.
Info. Enabling this option does not weaken your Termux’ security. The third-party apps still need to request the user to allow running arbitrary commands in Termux like any other dangerous permissions.
2.2.3 Component Tabs
Activities, Services, Receivers (originally broadcast receivers) and Providers (originally Content Providers) are together called the application components. This is because they share similar features in many ways. For example, they all have a name and a label. Application components are the building blocks of any application, and most of these have to declared in the application manifest. Application manifest is a file where application specific metadata are stored. The Android operating system learns what to do with an app by reading the metadata. Colours used in these tabs are explained in §2.2.1. You also have the ability to sort the list of components to display blocked or tracker components on top of the list using the Sort option in the overflow menu.
2.2.3.1 Activities
Activities are windows or pages that you can browse (for instance Main page and App Details page are two separate activities). In other words, an activity is a user interface (UI) component. Each activity can have multiple UI components known as widgets or fragments, and similarly, each of these latter components can have multiple of them nested or on top of each other. But an activity is the master component: There cannot be two nested activities. An application author can also choose to open external files within an activity using a method called intent filters. When you try to open a file using your file manager, either your file manager or system scans for intent filters to decide which activities can open that particular file and offers you to open the file with these activities (therefore, it is nothing to do with the application itself). There are other intent filters as well.
Activities which are exportable can be usually opened by any third-party apps (some activities require permissions, if that is the case, only an app having those permissions can open them). In the Activities tab, the name of the activity (on top of each list item) is actually a button. It is enabled for the exportable activities and disabled for others (root users can open any activities). You can click on the button to open the activity directly in App Manager. You can also open the Interceptor page by long clicking on an activity. Currently, it only works for exportable activities.
Notice. If you are not able to open any activity, chances are it has certain dependencies which are not met, e.g. you cannot open App Details Activity because it requires that you at least supply a package name. These dependencies cannot always be inferred programmatically. Therefore, you cannot open them using App Manager.
You can also create shortcut for these exportable activities (using the dedicated button), and if you want, you can edit the shortcut as well using the Edit Shortcut button.
Caution. If you uninstall App Manager, all shortcuts created by App Manager will be lost.
2.2.3.2 Services
Unlike activities which users can see, Services handle background tasks. If you’re, for example, downloading a video from the internet using your phone’s Internet browser, the Internet browser is using a foreground service to download the content.
When you close an activity, it usually gets destroyed immediately (depending on many factors such as how much free memory your phone has). But services can be run for indefinite periods if desired. If more services are running in background, your phone will get slower due to shortage of memory and/or processing power, and your phone’s battery can be drained more quickly. Newer Android versions have a battery optimisation feature enabled by default for all apps. With this feature enabled, the system can randomly terminate any service.
Configure in-app language. App Manager currently supports 15 (fifteen) languages.
2.2.3.3 Receivers
Configure in-app theme.
2.2.3.4 Providers
Providers (also called content providers) are used for data management. For example, when you save an apk file or export rules in App Manager, it uses a content provider called ‘androidx.core.content.FileProvider‘ to save the APK or export the rules. There are other content providers or even custom ones to manage various content-related tasks such as database management, tracking, searching, etc. Each content provider has a field called Authority which is unique to that particular app in the entire Android eco-system just like the package name.
2.2.3.5 Additional Features for Rooted Phones
Unlike non-root users who are mostly spectators in these tabs, root users can perform various operations.
Blocking Components On the right-most side of each component item, there is a “block” icon (which becomes a “unblock/restore” icon when the component is being blocked). This icon (actually, a button) can be used to toggle the blocking status of that particular component. If you do not have Instant Component Blocking enabled or haven’t applied blocking for the app before, you have to apply the changes using the Apply rules option in three-dots menu. You can also remove already applied rules using the same option (which would be read as Remove rules this time).
Turning off this option disables the App Usage page as well as data usage and app storage info in the App Info tab. With this option turned off, App Manager will never ask for Usage Access permission.
Blocking Trackers You can disable tracker components using the Block tracker option in the three-dots menu. All tracker components will be blocked regardless of the tab you’re currently in.
Info. Tracker components are a subset of app components. Therefore, they are blocked using the same method used for blocking any other components.
2.2.4 Permission Tabs
App Ops, Uses Permissions and Permissions tabs are related to permissions. In Android communication between apps or processes which do not have the same identity (known as shared id) often require permission(s). These permissions are managed by the permission controller. Some permissions are considered normal permissions which are granted automatically if they appear in the application manifest, but dangerous and development permissions require confirmation from the user. Colours used in these tabs are explained in §2.2.1.
2.2.4.1 App Ops
App Ops stands for Application Operations. Since Android 4.3, App Ops are used by Android system to control most of the application permissions. Each app op has a unique number associated with them which are closed inside first brackets in the App Ops tab. They also have private and optionally a public name. Some app ops are associated with permissions as well. The dangerousness of an app op is decided based on the associated permission, and other informations such as flags, permission name, permission description, package name, group are taken from the associated permission. Other information may include the following:
- Mode. It describes the current authorisation status which can be allow, deny (a rather misnomer, it simply means error), ignore (it actually means deny), default (inferred from a list of defaults set internally by the vendor), foreground (in newer Androids, it means the app op can only be used when the app is running in foreground), and some custom modes set by the vendors (MIUI uses ask and other modes with just numbers without any associated names).
- Duration. The amount of time this app op has been used (there can be negative durations whose use cases are currently not known to me).
- Accept Time. Last time the app op was accepted.
- Reject Time. Last time the app op was rejected.
Info. Contents of this tab are only visible to the root and ADB users.
There is a toggle button next to each app op item which can be used to allow or deny (ignore) the app op. You can also reset your changes using the Reset to default option or deny all dangerous app ops using the corresponding option in the menu. You can also sort them in ascending order by app op names and the associated unique numbers (or values). You can also list the denied app ops first using the corresponding sorting option.
Warning. Denying an app op may cause the app to misbehave. Use the reset to default option if that is the case.
See also: Appendix: App Ops
2.2.4.2 Uses Permissions
Uses Permissions are the permissions used by the application. This is named so because they are declared in the manifest using uses-permission tags. Information such as flags, permission name, permission description, package name, group are taken from the associated permission.
In order to ensure device security, you should stop ADB over TCP right after AM detects it. To do that, connect your device to your PC or Mac and run the following command:
Info. Since dangerous permissions are revoked by default by the system, revoking all dangerous permissions is the same as resetting all permissions.
Notice. Permissions cannot be changed for apps targeting API 23 or earlier. Therefore, permission toggles are disabled for such apps.
Users can sort the permissions by permission name (in ascending order) or choose to display denied or dangerous permissions at first using the corresponding options in the menu.
2.2.4.3 Permissions
Permissions are usually custom permissions defined by the app itself. It could contain regular permissions as well, mostly in old applications. Here’s a complete description of each item that is displayed there:
- Name. Each permission has a unique name like android.permission.INTERNET but multiple app can request the permission.
- Icon. Each permission can have a custom icon. The other permission tabs do not have any icon because they do not contain any icon in the app manifest.
- Description. This optional field describes the permission. If there isn’t any description associated with the permission, the field is not displayed.
- Flags. (Uses the flag symbol or Protection Level name) This describes various permission flags such as normal, development, dangerous, instant, granted, revoked, signature, privileged, etc.
- Package Name. Denotes the package name associated with the permission, i.e. the package that defined the permission.
- Group. The group name associated with the permission (if any). Newer Androids do not seem to use group names which is why you’ll usually see android.permission-group.UNDEFINED or no group name at all.
2.2.5 Signatures Tab
Set which compression method to be used during backups. App Manager supports GZip and BZip2 compression methods, GZip being the default compression method. It doesn’t affect the restore of an existing backup.
There are three types of checksums displayed there: MD5, SHA1 and SHA256.
Caution. It is recommended that you verify signing info using only SHA256 checksums or all three of them. DO NOT rely on MD5 or SHA1 checksums only as they are known to generate the same results for multiple certificates.
2.2.6 Other Tabs
Set an encryption method for the backups. AM currently supports OpenPGP only.
2.3 1-Click Ops Page
This page appears after clicking on the 1-Click Ops option in the main menu.
2.6.9 Device Info
Display Android version, security, CPU, GPU, battery, memory, screen, languages, user info, etc.
Notice. Certain apps may not function as expected after applying the blocking. If that is the case, remove blocking rules all at once or one by one in the component tabs of the corresponding App Details page.
2.3.2 Block Components…
This option can be used to block certain app components denoted by the signatures. App signature is the full name or partial name of the components. For safety, it is recommended that you should add a . (dot) at the end of each partial signature name as the algorithm used here chooses all matched components in a greedy manner. You can insert more than one signature in which case all signatures have to be separated by spaces. Similar to the option above, there is an option to apply blocking to system apps as well.
Caution. If you are not aware of the consequences of blocking app components by signature(s), you should avoid using this setting as it may result in boot loop or soft brick, and you may have to apply factory reset in order to use your OS.
2.3.3 Set Mode for App Ops…
This option can be used to configure certain app operations of all or selected apps. You can insert more than one app op constants separated by spaces. It is not always possible to know in advance about all the app op constants as they vary from device to device and from OS to OS. To find the desired app op constant, browse the App Ops tab in the App Details page. The constants are integers closed inside brackets next to each app op name. You can also use the app op names. You also have to select one of the modes that will be applied against the app ops.
Caution. Unless you are well-informed about app ops and the consequences of blocking them, you should avoid using this feature as it may result in boot loop or soft brick, and you may have to apply factory reset in order to use your OS.
2.4 Profiles Page
Profiles page can be accessed from the options-menu in the main page. It displays a list of configured profiles. Profiles can be added using the plus button at the bottom-right corner, imported from the import option, created from one of the presets or even duplicated from an already existing profile. Clicking on any profile opens the profile page.
2.4.1 Options Menu
There are two options menu in this page. The three dots menu at the top-right offers two options such as presets and import.
- Presets. Presets option lists a number of built-in profiles that can be used as a starting point. The profiles are generated from the project Universal Android Debloater.
See also: FAQ: What are bloatware and how to remove them? - Import. This option can be used to import an existing profile.
Another options menu appears when you long click on any profile. They have options such as–
- Apply now…. This option can be used to apply the profile directly. When clicked, a dialog will be displayed where you can select a profile state. On selecting one of the options, the profile will be applied immediately.
- Delete. Clicking on delete will remove the profile immediately without any warning.
- Duplicate. This option can be used to duplicate the profile. When clicked, an input box will be displayed where you can set the profile name. If you click “OK”, a new profile will be created and the profile page will be loaded. The profile will not be saved until you save it manually.
- Export. Export the profile to an external storage. Profile exported this way can be imported using the import option in the three dots menu.
- Create shortcut. This option can be used to create a shortcut for the profile. When clicked, there will be two options: Simple and Advanced. The latter option allows you to set the profile state before applying it while the former option use the default state that was configured when the profile was last saved.
2.5 Profile Page
Profile page displays the configurations for a profile. It also offers editing them.
Notice. When you apply a profile, if some packages do not match the criteria, they will simply be ignored.
2.5.1 Options Menu
The three dots menu on the top-right corner opens the options-menu. It contains several options such as–
- Apply. This option can be used to apply the profile. When clicked, a dialog will be displayed where you can select a profile state. On selecting one of the options, the profile will be applied immediately.
- Save. Allows you to save the profile.
Notice. Changes are never saved automatically. You have to save them manually from here.
- Discard. Discard any modifications made since the last save.
- Delete. Clicking on delete will remove the profile immediately without any warning.
- Duplicate. This option can be used to duplicate the profile. When clicked, an input box will be displayed where you can set the profile name. If you click “OK”, a new profile will be created, and the page will be reloaded. The profile will not be saved until you save it manually.
- Create shortcut. This option can be used to create a shortcut for the profile. When clicked, there will be two options: Simple and Advanced. The latter option allows you to set the profile state before applying it while the former option uses the default state that was configured when the profile was last saved.
2.5.2 Apps Tab
Apps tab lists the packages configured under this profile. Packages can be added or removed using the plus button located near the bottom of the screen. Packages can also be removed by long clicking on them (in which case, a popup will be displayed with the only option delete).
2.5.3 Configurations Tab
Configurations tab can be used to configure the selected packages. Description of each item is given below:
2.5.3.1 Comment
This is the text that will be displayed in the profiles page. If not set, the current configurations will be displayed instead.
2.5.3.2 State
Shared preferences can be edited in this page. Clicking any item on the list opens the edit dialog where the item can be edited. The floating action button on the bottom-right corner can be used to add a new item. To save or delete the file, or to discard current changes, the respective options in the menu can be used.
2.5.3.3 Users
Most of the features supported by ADB mode are enabled by default once ADB support is detected by AM. These include disable, force-stop, clear data, grant/revoke app ops and permissions. You can also install applications without any prompt and view running apps/processes.
2.5.3.4 Components
This behaves the same way as the Block Components… option does in the 1-Click Ops page. However, this only applies for the selected packages. If the state is on, the components will be blocked, and if the state is off, the components will be unblocked. The option can be disabled (regardless of the inserted values) by clicking on the disabled button on the input dialog.
See also: FAQ: ADB over TCP
2.5.3.5 App Ops
This behaves the same way as the Set Mode for App Ops… option does in the 1-Click Ops page. However, this only applies for the selected packages. If the state is on, the app ops will be denied (ie. ignored), and if the state is off, the app ops will be allowed. The option can be disabled (regardless of the inserted values) by clicking on the disabled button on the input dialog.
2.5.3.6 Permissions
This option can be used to grant or revoke certain permissions from the selected packages. Like others above, permissions must be separated by spaces. If the state is on, the permissions will be revoked, and if the state is off, the permissions will be allowed. The option can be disabled (regardless of the inserted values) by clicking on the disabled button on the input dialog.
2.5.3.7 Backup/Restore
AppOpsManager.PackageOps is a data structure to store all the OpEntry for a package. In simple terms, it stores all the customised operations for a package.
- Backup options. Same as the backup options of the backup/restore feature. If not set, the default options will be used.
- Backup name. Set a custom name for the backup. If the backup name is set, each time a backup is made, it will be given a unique name with backup-name as the suffix. This behaviour will be fixed in a future release. Leave this field empty for regular or “base” backup (also, make sure not to enable backup multiple in the backup options).
If the state is on, the packages will be backed up, and if the state is off, the packages will be restored. The option can be disabled by clicking on the disabled button on the input dialog.
2.5.3.8 Export Blocking Rules
This option allows you to export blocking rules.
Danger. This option is not yet implemented.
2.5.3.9 Disable
Enabling this option will enable/disable the selected packages depending on the state. If the state is on, the packages will be disabled, and if the state is off, the packages will be enabled.
2.5.3.10 Force-stop
Enabling this option will allow the selected packages to be force-stopped.
2.5.3.11 Clear Cache
Enabling this option will enable clearing cache for the selected packages.
2.5.3.12 Clear Data
In order to enable ADB over TCP, you have to set up ADB in your PC or Mac. Lineage OS users can skip to §3.1.4.1.
3.1.3.1 Windows
Enabling this option will block/unblock tracker components from the selected packages depending on the state. If the state is on, the trackers will be blocked, and if the state is off, the trackers will be unblocked.
2.5.3.14 Backup APK
Enabling this option will enable APK backup for the selected packages. This is not the same as backup/restore as described there.
2.6 Settings Page
Settings can be used to customise the behaviour of the app.
2.6.1 Language
Configure in-app language. App Manager currently supports 15 (fifteen) languages.
2.6.2 App Theme
Configure in-app theme.
2.6.3 Mode of Operation
You can select one of the four options:
- Auto. Let AM decide the suitable option for you. Although this is the default option, it may cause problems in some devices.
- Root. Select root mode. By default, AM requests root permission if root is detected but hasn’t been granted. If this option is selected, AM will run in root mode even if root is unavailable or denied. This may cause crashes or freezing issues, therefore, shouldn’t be enabled if root is unavailable.
- ADB over TCP. Enable ADB over TCP mode. AM may hang indefinitely if ADB over TCP is not enabled.
- No-root. AM runs in no-root mode. AM performs better if this is enabled but all the root/ADB features will be disabled.
2.6.4 Usage Access
Turning off this option disables the App Usage page as well as data usage and app storage info in the App Info tab. With this option turned off, App Manager will never ask for Usage Access permission.
2.6.5 APK Signing
2.6.5.1 Signature schemes
Select the signature schemes to use. It is recommended that you use at least v1 and v2 signature schemes. Use the Reset to Default button in case you’re confused.
2.6.6 Rules
3.1.4.2 Enable ADB over TCP via PC or Mac
For other ROMs, you can do this using the command prompt/PowerShell/terminal emulator that you’ve opened in the step 3 of the previous section. In this section, I will use adb to denote ./adb, adb or any other command that you needed to use based on your platform and software in the previous section.
Notice. Enabling this setting may have some unintended consequences, such as rules that are not completely removed will be applied again. So, proceed with caution. This option should be kept disabled if not required for some reasons.
See also: FAQ: What is instant component blocking?
2.6.6.2 Import/Export Blocking Rules
It is possible to import or export blocking rules within App Manager for all apps. There is a choice to export or import only certain rules (components, app ops or permissions) instead of all of them. It is also possible to import blocking rules from Blocker and Watt. If it is necessary to export blocking rules for a single app, use the corresponding App Details page to export rules, or for multiple apps, use batch operations.
See also: Rules Specification
Export Export blocking rules for all apps configured within App Manager. This may include app components, app ops and permissions based on the options selected in the multi-choice options.
Import Import previously exported blocking rules from App Manager. Similar to export, this may include app components, app ops and permissions based on the options selected in the multi-choice options.
Import Existing Rules Add components disabled by other apps to App Manager. App Manager only keeps track of component disabled within App Manager. If you use other tools to block app components, you can use this tools to import these disabled components. Clicking on this option triggers a search for disabled components and will lists apps with components disabled by user. For safety, all the apps are unselected by default. You can manually select the apps in the list and re-apply the blocking through App Manager.
Caution. Be careful when using this tool as there can be many false positives. Choose only the apps that you are certain about.
Import from Watt Import configuration files from Watt, each file containing rules for a single package and file name being the name of the package with .xml extension.
Tip. Location of configuration files in Watt: /sdcard/Android/data/com.tuyafeng.watt/files/ifw
Import from Blocker Import blocking rules from Blocker, each file containing rules for a single package. These files have a .json extension.
3.1.4.4 Stop ADB over TCP
In order to ensure device security, you should stop ADB over TCP right after AM detects it. To do that, connect your device to your PC or Mac and run the following command:
2.6.7 Installer
Installer specific options
2.6.7.1 Show users in installer
For root/ADB users, a list of users will be displayed before installing the app. The app will be installed only for the specified user (or all users if selected).
2.6.7.2 Sign APK
Whether to sign the APK files before installing the app. See APK signing section above to configure signing.
2.6.7.3 Install location
Choose APK install location. This can be one of auto, internal only and prefer external. In newer Android versions, the last option may not always install the app in the external storage.
2.6.7.4 Installer App
App Manager has a modern, advanced and easy-to-use backup/restore system implemented from the scratch. This is probably the only app that has the ability to restore not only the app or its data but also permissions and rules that you’ve configured within App Manager. You can also choose to back up an app multiple times (with custom names) or for all users.
2.6.8 Backup/Restore
Settings related to backup/restore.
2.6.8.1 Compression method
Set which compression method to be used during backups. App Manager supports GZip and BZip2 compression methods, GZip being the default compression method. It doesn’t affect the restore of an existing backup.
2.6.8.2 Backup Options
Customise the backup/restore dialog.
2.6.8.3 Backup apps with Android KeyStore
Allow backup of apps that has entries in the Android KeyStore (disabled by default). Some apps (such as Signal) may crash if restored. KeyStore backup also doesn’t work from Android 9 but still kept as many apps having KeyStore can be restored without problem.
2.6.8.4 Encryption
Set an encryption method for the backups. AM currently supports OpenPGP only.
Caution. In v2.5.16, App Manager doesn’t remember key IDs for a particular backup. You have to remember them yourself. This has been fixed in v2.5.18.
2.6.9 Device Info
Display Android version, security, CPU, GPU, battery, memory, screen, languages, user info, etc.
2.7 Scanner Page
Scanner page appears after clicking on the scanner button in the App Info tab. External APK files can also be opened for scanning from file managers, web browsers, etc.
It scans for trackers and libraries, and displays the number of trackers and libraries as a summary. It also displays checksums of the APK file as well as the signing certificate(s).
Disclaimer. AM only scans an app statically without prejudice. The app may provide the options for opting out, or in some cases, certain features of the tracker may not be used at all by the app (e.g. F-Droid), or some apps may simply use them as placeholders to prevent the breaking of certain features (e.g. Fennec F-Droid). The intention of the scanner is to give you an idea about what the APK might contain. It should be taken as an initial step for further investigations.
Clicking on the first item (i.e. number of classes) opens a new page containing a list of tracker classes for the app. All classes can also be viewed by clicking on the Toggle Class Listing menu. A sneak-peek of each class can be viewed by simply clicking on any class item.
Notice. Due to various limitations, it is not possible to scan all the components of an APK file. This is especially true if an APK is highly obfuscated. The scanner also does not check strings (or website signatures).
Restore respects all the backup options and will fail if Source option is set, but the backup doesn’t contain any source backups or in other cases, if the app isn’t installed. When restoring backups for multiple packages, you can only restore the base backups (see backup section for an explanation). However, when restoring backups for a single package, you have the option to select which backup to restore. If All users option is set, AM will restore the selected backup for all users in the latter case but in the former case, it will restore base backups for the respective users.
The third item lists the number of libraries along with their names. The information are mostly taken from IzzyOnDroid repo.
See also: FAQ: Tracker classes vs tracker components
2.7.1 Missing Signatures
At the bottom of the page, there is a special item denoting the number of missing signatures (i.e. missing classes). The missing signatures are the ones that AM has failed to match against any known libraries. The number itself has no particular meaning as many libraries contain hundreds of classes, but clicking on the item will bring up a dialog containing the signatures which is helpful in inspecting the missing signatures. This feature is only intended for people who know what a missing signature is and what to do with it, average users should just ignore it.
2.8 Interceptor Page
Interceptor can be used to intercept communication between apps using Intent. It works as a man-in-the-middle between the source and the destination apps. It offers a feature-complete user interface for editing Intents.
Info. Development of interceptor is still in progress. It can only intercept activities for now.
Warning. Interceptor only works for implicit intents where the app component isn’t specified.
2.8.1 Intent Filters
Intent filters are used by the apps to specify which tasks they are able to perform or which tasks they are going to perform using other apps. For example, when you’re opening a PDF file using a file manager, the file manager will try to find which apps to open the PDF with. To find the right applications, the file manager will create an Intent with filters such as MIME type and ask the system to retrieve the matched applications that is able to open this filter. The system will search through the Manifest of the installed applications to match the filter and list the app components that are able to open this filter (in our case the PDF). At this, either the file manager will open the desired app component itself or use a system provided option to open it. If multiple app components are able to open it and no default is set, you may get a prompt where you have to choose the right app component.
2.8.1.1 Action
Action specifies the generic action to perform such as android.intent.action.VIEW. Applications often declare the relevant actions in the Manifest file to catch the desired Intents. The action is particularly useful for broadcast Intent where it plays a vital rule. In other cases, it works as an initial way to filter out relevant app components. Generic actions such as android.intent.action.VIEW and android.intent.action.SEND are widely used by apps. So, setting this alone may match many app components.
2.8.1.2 Data
No. But components blocked by the Android System or any other tools are displayed in the App Details page (within the component tabs). In v2.5.12 and onwards, you can import these rules in Settings. But since there is no way to distinguish between components blocked by third-party apps and components blocked by the System, you should be very careful when choosing app.
Examples:
https://developer.android.com/reference/android/net/Uri
file:///sdcard/AppManager.apk
mailto:email@example.com
content://io.github.muntashirakon.AppManager.provider/23485af89b08d87e898a90c7e/AppManager.apk
2.8.1.3 MIME Type
MIME type of the data. For example, if the data field is set to file:///sdcard/AppManager.apk, the associated MIME type can be application/vnd.android.package-archive.
2.8.1.4 Categories
This is similar to action in the sense that it is also used by the system to filter app components. This has no further benefits. Unlike action, there can be more than one category. Clicking on the plus button next to the title allows adding more categories.
2.8.1.5 Flags
Install app only for the current user at the time of restoring backups. Support for split apks is also added.
2.8.1.6 Extras
Extras are the key-value pairs used for supplying additional information to the destination component. You can add extras using the plus button next to the title.
2.8.1.7 URI
Represents the entire Intent as a URI (e.g. intent://…). Some data cannot be converted to string, and as a result, they might not appear here.
2.8.2 Matching Activities
List all the activity components that matches the Intent. This is internally determined by the system (rather than AM). The launch button next to each component can be used to launch them directly from AM.
4.2.1 Do I have to enable ADB over TCP everytime I restart?
Figure C.0 describes the process of changing and processing permission. AppOpsManager can be used to manage permissions in Settings app. AppOpsManager is also useful in determining if a certain permission (or operation) is granted to the application. Most of the methods of AppOpsManager are accessible to the user app but unlike a system app, it can only be used to check permissions for any app or for the app itself and start or terminating certain operations. Moreover, not all operations are actually accessible from this Java class. AppOpsManager holds all the necessary constants such as OP_*, OPSTR_*, MODE_* which describes operation code, operation string and mode of operations respectively. It also holds necessary data structures such as PackageOps and OpEntry. PackageOps holds OpEntry for a package, and OpEntry, as the name suggests, describes each operation.
4.2.2 Cannot enable USB debugging. What to do?
See also: AppOpsManager documentation
2.9 Shared Preferences Editor Page
Shared preferences can be edited in this page. Clicking any item on the list opens the edit dialog where the item can be edited. The floating action button on the bottom-right corner can be used to add a new item. To save or delete the file, or to discard current changes, the respective options in the menu can be used.
Chapter 3
Guides
3.1 ADB over TCP
Most of the features supported by ADB mode are enabled by default once ADB support is detected by AM. These include disable, force-stop, clear data, grant/revoke app ops and permissions. You can also install applications without any prompt and view running apps/processes.
Root users. If superuser permission has been granted to App Manager, it can already execute privileged code without any problem. Therefore, root users don’t need to enable ADB over TCP. If you still want to use ADB over TCP, you must revoke superuser permission for App Manager and restart your device. You may see working on ADB mode message without restarting but this isn’t entirely true. The server (used as an interface between system and App Manager) is still running in root mode. This is a known issue and will be fixed in a future version of App Manager.
See also: FAQ: ADB over TCP
C.3.2 MODE_* Constants
3.1.1.1 Location of developer options
Developer options is located in Android Settings, either directly near the bottom of the page (in most ROMs) or under some other settings such as System (Lineage OS, Asus Zenfone 8.0+), System > Advanced (Google Pixel), Additional Settings (Xiaomi MIUI, Oppo ColorOS), More Settings (Vivo FuntouchOS), More (ZTE Nubia). Unlike other options, it is not visible until explicitly enabled by the user. If developer options is enabled, you can use the search box in Android Settings to locate it as well.
3.1.1.2 How to enable developer options
This option is available within Android Settings as well but like the location of the developer options, it also differs from device to device. But in general, you have to find Build number (or MIUI version for MIUI ROMs and Software version for Vivo FuntouchOS, Version for Oppo ColorOS) and tap it at least 7 (seven) times until you finally get a message saying You are now a developer (you may be prompted to insert pin/password/pattern or solve captchas at this point). In most devices, it is located at the bottom of the settings page, inside About Phone. But the best way to find it is to use the search box.
C.3.3 PackageOps
AppOpsManager.PackageOps is a data structure to store all the OpEntry for a package. In simple terms, it stores all the customised operations for a package.
3.1.2.1 Xiaomi (MIUI)
Enable USB debugging (security settings) as well.
3.1.2.2 Huawei (EMUI)
Enable Allow ADB debugging in charge only mode as well. When connecting to your PC or Mac, you may get a prompt saying Allow access to device data? in which case click YES, ALLOW ACCESS.
Notice. Often the USB debugging mode could be disabled automatically by the system. If that’s the case, repeat the above procedure.
3.1.2.3 LG
Make sure you have USB tethering enabled.
3.1.2.4 Troubleshooting
In case USB Debugging is greyed out, you can do the following:
- Make sure you enabled USB debugging before connecting your phone to the PC or Mac via USB cable
- Enable USB tethering after connecting to PC or Mac via USB cable
- (For Samsung) If your device is running KNOX, you may have to follow some additional steps. See official documentations or consult support for further assistant
3.1.3 Setup ADB on PC or Mac
In order to enable ADB over TCP, you have to set up ADB in your PC or Mac. Lineage OS users can skip to §3.1.4.1.
3.1.3.1 Windows
- Download the latest version of Android SDK Platform-Tools for Windows
- Extract the contents of the zip file into any directory (such as C:\adb) and navigate to that directory using Explorer
- Open Command Prompt or PowerShell from this directory. You can do it manually from the start menu or by holding Shift and Right clicking within the directory in File Explorer and then clicking either on Open command window here or on Open PowerShell window here (depending on what you have installed). You can now access ADB by typing adb (Command Prompt) or ./adb (PowerShell). Do not close this window yet
3.1.3.2 macOS
- Download the latest version of Android SDK Platform-Tools for macOS
- Extract the contents of the zip file into a directory by clicking on it. After that, navigate to that directory using Finder and locate adb
- Open Terminal using Launchpad or Spotlight and drag-and-drop adb from the Finder window into the Terminal window. Do not close the Terminal window yet
Tip. If you are not afraid to use command line, here’s a one liner:
https://dl.google.com/android/repository/platform-tools-latest-darwin.zip &&
unzip platform-tools.zip && rm platform-tools.zip && cd platform-tools
After that, you can simply type ./adb in the in same Terminal window to access ADB.
3.1.3.3 Linux
- Open your favourite terminal emulator. In most GUI-distros, you can open it by holding Control, Alter and T at the same time
- Run the following command:
- If it is successful, you can simply type ./adb in the in same terminal emulator window or type ~/Downloads/platform-tools/adb in any terminal emulator to access ADB.
3.1.4 Configure ADB over TCP
3.1.4.1 Lineage OS
Lineage OS (or its derivatives) users can directly enable ADB over TCP using the developer options. To enable that, go to the Developer options, scroll down until you find ADB over Network. Now, use the toggle button on the right-hand side to enable it and skip to §3.1.4.3.
3.1.4.2 Enable ADB over TCP via PC or Mac
For other ROMs, you can do this using the command prompt/PowerShell/terminal emulator that you’ve opened in the step 3 of the previous section. In this section, I will use adb to denote ./adb, adb or any other command that you needed to use based on your platform and software in the previous section.
- Connect your device to your PC or Mac using a USB cable. For some devices, it is necessary to turn on File transfer mode (MTP) as well
- To confirm that everything is working as expected, type adb devices in your terminal. If your device is connected successfully, you will see something like this:
Notice. In some Android phones, an alert prompt will be appeared with a message Allow USB Debugging in which case, check Always allow from this computer and click Allow.
- Finally, run the following command to enable ADB over TCP:
Danger. You cannot disable developer options or USB debugging after enabling ADB over TCP.
3.1.4.3 Enable ADB mode on App Manager
After enabling ADB over TCP (in the previous subsections), open App Manager (AM). You should see working on ADB mode toast message at the bottom. If not, remove AM from the recents and open AM again from the launcher. If you see the toast message, you can safely stop ADB over TCP.
Notice. In some Android phones, the USB cable is needed to be disconnected from the PC in order for it to work.
Warning. ADB over TCP will be disabled after a restart. In that case, you have to follow §3.1.4.2 again.
3.1.4.4 Stop ADB over TCP
In order to ensure device security, you should stop ADB over TCP right after AM detects it. To do that, connect your device to your PC or Mac and run the following command:
Replace adb with ./adb or any other command that you had to use in previous steps.
Lineage OS users. You can turn off ADB over Network in developer options, but turning off this option will also stop App Manager’s remote server. So, turn it off only when you’re not going to use App Manager in ADB over TCP mode.
3.1.5 References
- How to Install ADB on Windows, macOS, and Linux
- Android Debug Bridge (adb)
- How to fix USB debugging greyed out?
3.2 Backup/Restore
App Manager has a modern, advanced and easy-to-use backup/restore system implemented from the scratch. This is probably the only app that has the ability to restore not only the app or its data but also permissions and rules that you’ve configured within App Manager. You can also choose to back up an app multiple times (with custom names) or for all users.
Notice. Backup/Restore is completely different from Backup APK which is also a part of the batch operations.
Warning. As of v2.5.22, backup/restore is a beta feature (previously, it was an alpha feature). Support for old backups are removed as a result. From now on, backward compatibility will be provided.
3.2.1 Location
Backup/restore is a part of batch operations. It is also located inside the options menu in the App Info tab. Clicking on Backup/Restore opens the Backup Options. The backups are currently located at /sdcard/AppManager.
Note. If one or more selected apps don’t have any backup, the Restore and Delete Backup options will not be displayed.
3.2.2 Backup Options
Backup options (internally known as backup flags) let you customise the backups on the fly. However, the customisations will not be remembered for the future backups. If you want to customise this dialog, use Backup Options in the Settings page.
A complete description of backup options is given below:
- Source. Whether to back up or restore the entire source directory. When you install an app, the APK files are stored inside the /data/app/ along with any native libraries as well as some other files such as the ODEX and VDEX files. This directory is called source directory or code path. You can further customise this using the APK only option.
- APK only. When you enable Source option, the whole source directory is backed up or restored. Enabling this along with Source will only backup or restore the APK files and skip backing up the native libraries or ODEX and VDEX files.
- Data. Whether to back up the internal data directories. These directories are located at /data/user/<user_id> and (for Android N or later) /data/user_de/<user_id>.
- External data. Whether to back up data directories located in the internal memory as well as SD Card (if exists). External data directories often contain non-essential app data or media files (instead of using the dedicated media folder) and may increase the backup size. However, it might be essential for some apps. Although it isn’t checked by default (as it might dramatically increase the size of the backups), you will need to check it in order to ensure a smooth restore of your backups.
- OBB and media. Whether to back up or restore the OBB and the media directories located in the external storage or the SD Card. This is useful for games and the graphical software which actually use these folders.
- Exclude cache. Android apps have multiple cache directories located at every data directories (both internal and external). There are two types of cache: cache and code cache. Enabling this option excludes both cache directories from all the data directories. It is generally advised to exclude cache directories since most apps don’t clear the cache (for some reason, the only way an app can clear its cache is by deleting the entire cache directory) and usually handled by the OS itself. Apps such as Telegram may use a very large cache (depending on the storage space) which may dramatically increase your backup size. When it is enabled, AM also ignores backup from the no_backup directories.
- Extras. Backup/restore app permissions, net policy, battery optimization, SSAID, etc. It’s enabled by default. Note that, blocking rules are applied after applying the extras. So, if an item is present in both places, it will be overwritten (i.e., the one from the blocking rules will be used).
- Rules. This option lets you back up blocking rules configured within App Manager. This might come in handy if you have customised permissions or block some components using App Manager as they will also be backed up or restored when you enable this option.
- Backup Multiple. Whether this is a multiple backup. By default, backups are saved using their user ID. Enabling this option allows you to create additional backups. These backups use the current date-time as the default backup name, but you can also specify custom backup name using the input field displayed when you click on the Backup button.
- Custom users. Backup or restore for the selected users instead of only the current user. This option is only displayed if the system has more than one user.
- Skip signature checks. When taking a backup, checksum of every file (as well as the signing certificate(s) of the base APK file) is generated and stored in the checksums.txt file. When you restore the backup, the checksums are generated again and are matched with the checksums stored in the said file. Enabling this option will disable the signature checks. This option is applied only when you restore a backup. During backup, the checksums are generated regardless of this option.
Caution. You should always disable this option to ensure that your backups are not modified by any third-party applications. However, this would only work if you enabled encryption.
3.2.3 Backup
Backup respects all the backup options except Skip signature checks. If base backups (i.e., backups that don’t have the Backup Multiple option) already exist, you will get a warning as the backups will be overwritten. If Backup Multiple is set, you have an option to input the backup name, or you can leave it blank to use the current date-time.
3.2.4 Restore
Restore respects all the backup options and will fail if Source option is set, but the backup doesn’t contain any source backups or in other cases, if the app isn’t installed. When restoring backups for multiple packages, you can only restore the base backups (see backup section for an explanation). However, when restoring backups for a single package, you have the option to select which backup to restore. If All users option is set, AM will restore the selected backup for all users in the latter case but in the former case, it will restore base backups for the respective users.
Notice. Apps that use storage access framework (SAF), SSAID or Android KeyStore works properly only after an immediate restart.
3.2.5 Delete Backup
Delete backup only respects All users option and when it is selected, only the base backups for all users will be deleted with a prompt. When deleting backups for a single package, another dialog will be displayed where you can select the backups to delete.
3.2.6 Encryption
App Manager currently supports OpenPGP encryption. To enable it, you need to install an OpenPGP provider such as OpenKeychain. To configure OpenPGP provider, go to the Settings page.
Chapter 4
Frequently Asked Questions
4.1 App Components
4.1.1 What are the app components?
Activities, services, broadcast receivers (also known as receivers) and content providers (also known as providers) are jointly called app components. More technically, they all inherit the ComponentInfo class.
B.3.3 Remove All Blocking Rules
In the Settings page, a new option is added which can be used to remove all blocking rules configured within App Manager.
Even IFW has some limitations which are primarily applicable for the system apps:
- App Ops are now generated using a technique similar to AppOpsX. This should decrease the loading time significantly in the App Ops tab.
- In the App Ops tab, a menu item is added which can be used to list only active app ops without including the default app ops. The preference is saved in the shared preferences.
4.1.3 Why are the components blocked by AM not detected by other related apps?
It is because of the blocking method I’m using. This method is called Intent Firewall (IFW) and is compatible with Watt and Blocker. MyAndroidTool (MAT) supports IFW, but it uses a different format. Therefore, Watt can detect blocked components by default but Blocker can only detect them if you enable IFW in its settings page. MAT cannot detect AM’s blocking rules since the format is different. AM cannot detect MAT’s rules if IFW is enabled in MAT. In that case, you can still import them from the settings page. MAT has an export option, but it’s not supported due to its non-free nature.
4.1.4 Does app components blocked by other tools retained in AM?
No. But components blocked by the Android System or any other tools are displayed in the App Details page (within the component tabs). In v2.5.12 and onwards, you can import these rules in Settings. But since there is no way to distinguish between components blocked by third-party apps and components blocked by the System, you should be very careful when choosing app.
4.1.5 What happened to the components blocked by AM which are also blocked by other tools?
AM blocks the components again using Intent Firewall (IFW). They are not unblocked (if blocked using pm or Shizuku method) and blocked again. But if you unblock a component in the App Details page, it will be reverted back to default state —- blocked or unblocked as described in the corresponding app manifest —- using both IFW and pm method. However, components blocked by MyAndroidTools (MAT) with IFW method will not be unblocked by AM. To solve this issue, you can first import the corresponding configuration to AM in Settings in which case MAT’s configurations will be removed. But this option is only available from v2.5.12.
B.3.8 Batch Ops
When you block a component in the App Details page, the blocking is not applied by default. It is only applied when you apply blocking using the Apply rules option in the top-right menu. If you enable instant component blocking, blocking will be applied as soon as you block a component. If you choose to block tracker components, however, blocking is applied automatically regardless of this setting. You can also remove blocking for an app by simply clicking on Remove rules in the same menu in the App Details page. Since the default behaviour gives you more control over apps, it is better to keep instant component blocking option disabled.
4.1.7 Tracker classes versus tracker components
All app components are classes but not all classes are components. In fact, only a few of the classes are components. That being said, scanner page displays a list of trackers along with the number of classes, not just the components. In all other pages, trackers and tracker components are used synonymously to denote tracker components, i.e. blocking tracker means blocking tracker components, not tracker classes.
Info. Tracker classes cannot be blocked. They can only be removed by editing the app itself.
B.3.10 App Data Backup
Install app only for the current user at the time of restoring backups. Support for split apks is also added.
If you have Google Play Services (com.google.android.gms) installed, unblocking the following services may fix certain crashes:
- Ad Request Broker Service .ads.AdRequestBrokerService
- Cache Broker Service .ads.cache.CacheBrokerService
- Gservices Value Broker Service .ads.GservicesValueBrokerService
- Advertising Id Notification Service .ads.identifier.service.AdvertisingIdNotificationService
- Advertising Id Service .ads.identifier.service.AdvertisingIdService
4.2 ADB over TCP
4.2.1 Do I have to enable ADB over TCP everytime I restart?
Figure C.0 describes the process of changing and processing permission. AppOpsManager can be used to manage permissions in Settings app. AppOpsManager is also useful in determining if a certain permission (or operation) is granted to the application. Most of the methods of AppOpsManager are accessible to the user app but unlike a system app, it can only be used to check permissions for any app or for the app itself and start or terminating certain operations. Moreover, not all operations are actually accessible from this Java class. AppOpsManager holds all the necessary constants such as OP_*, OPSTR_*, MODE_* which describes operation code, operation string and mode of operations respectively. It also holds necessary data structures such as PackageOps and OpEntry. PackageOps holds OpEntry for a package, and OpEntry, as the name suggests, describes each operation.
4.2.2 Cannot enable USB debugging. What to do?
See also: AppOpsManager documentation
C.3.1 OP_* Constants
OP_* are the integer constants starting from 0. OP_NONE implies that no operations are specified whereas _NUM_OP denotes the number of operations defined in OP_* prefix. While they denote each operation, the operations are not necessarily unique. In fact, there are many operations that are actually a single operation denoted by multiple OP_* constant (possibly for future use). Vendors may define their own op based on their requirements. MIUI is one of the vendors who are known to do that.
4.2.4 Which features can be used in ADB mode?
Most of the features supported by ADB mode are enabled by default once ADB support is detected by AM. These include disable, force-stop, clear data, grant/revoke app ops and permissions. You can also install applications without any prompt and view running apps/processes.
4.3 Miscellanea
4.3.1 I don’t use root/ADB. Am I completely safe from any harms?
Yes. AM cannot modify any system settings without root or ADB over TCP.
C.3.2 MODE_* Constants
MODE_* constants also integer constants starting from 0. These constants are assigned to each operation describing whether an app is authorised to perform that operation. These modes usually have associated names such as allow for MODE_ALLOWED, ignore for MODE_IGNORED, deny for MODE_ERRORED (a rather misnomer), default for MODE_DEFAULT and foreground for MODE_FOREGROUND.
- To provide ADB over TCP support for the non-root users. ADB over TCP is a custom network protocol that usually runs on port 5555. Therefore, to connect to this port via localhost, AM needs this permission.
- MODE_ALLOWED. The app is allowed to perform the given operation
4.3.3 How are the trackers and libraries are updated?
Trackers and libraries are updated manually before making a new release.
C.3.3 PackageOps
AppOpsManager.PackageOps is a data structure to store all the OpEntry for a package. In simple terms, it stores all the customised operations for a package.
- Shizuku was initially non-free which led me to use a similar approach for App Manager to support both root and ADB
- App Manager already supports both ADB and root which in some cases is more capable than Shizuku
- Relying on a third-party app for the major functionalities is not a good design choice
- Integration of Shizuku will increase the complexity of App Manager.
4.3.5 What are bloatware and how to remove them?
Bloatware are the unnecessary apps supplied by the vendor or OEM and are usually system apps. These apps are often used to track users and collect user data which they might sell for profits. System apps do not need to request any permission in order to access device info, contacts and messaging data, and other usage info such as your phone usage habits and everything you store on your shared storage(s).
The bloatware may also include Google apps (such as Google Play Services, Google Play Store, Gmail, Google, Messages, Dialer, Contacts), Facebook apps (the Facebook app consists of four or five apps), Facebook Messenger, Instagram, Twitter and many other apps which can also track users and/or collect user data without consent given that they all are system apps. You can disable a few permissions from the Android settings but be aware that Android settings hides almost every permission any security specialist would call potentially dangerous.
If the bloatware were user apps, you could easily uninstall them either from Android settings or AM. Uninstalling system apps is not possible without root permission. You can also uninstall system apps using ADB, but it may not work for all apps. AM can uninstall system apps with root or ADB (the latter with certain limitations, of course), but these methods cannot remove the system apps completely as they are located in the system partition which is a read-only partition. If you have root, you can remount this partition to manually purge these apps but this will break Over the Air (OTA) updates since data in the system partition has been modified. There are two kind of updates, delta (small-size, consisting of only the changes between two versions) and full updates. You can still apply full updates, but the bloatware will be installed again, and consequently, you have to delete them all over again. Besides, not all vendors provide full updates.
Here:
From v2.5.19, AM has a new feature called profiles. The profiles page has an option to create new profiles from one of the presets. The presets consist of debloating profiles which can be used as a starting point to monitor, disable, and remove the bloatware from a proprietary Android operating system.
Note. In most cases, you cannot completely debloat your device. Therefore, it is recommended that you use a custom ROM free from bloatware such as Graphene OS, Lineage OS or their derivatives.
Appendix A
Specifications
A.1 Rules Specification
A.1.1 Background
AM currently supports blocking activities, broadcast receivers, content providers, services, app ops and permissions, and in future I may add more blocking options. In order to add more portability, it is necessary to import/export all these data.
TODO
A.1.2 Rules File Format
A.1.2.1 Internal
The instruction below follows the exact order given above:
Here:
- <name> – Component/permission/app op name (in case of app op, it could be string or integer)
- <type> – One of the ACTIVITY, RECEIVER, PROVIDER, SERVICE, APP_OP, PERMISSION
- pkg: Stores package info. It can contain any number of uid
- <component_status> – (For components) Component status
- true – Component has been applied (true value is kept for compatibility)
- false – Component hasn’t been applied yet, but will be applied in future (false value is kept for compatibility)
- unblocked – Component is scheduled to be unblocked
- <is_granted> – (For permissions) Whether the permission is granted or revoked
A.1.2.2 External
External format is used for importing or exporting rules in App Manager.
This the format is essentially the same as above except for the first item which is the name of the package.
Caution. The exported rules have a different format than the internal one and should not be copied directly to the conf folder.
Appendix B
Changelogs
B.1 v2.5.20 (375)
B.1.1 Introducing Profiles
Profiles finally closes the related issue. Profiles can be used to execute certain tasks repeatedly without doing everything manually. A profile can be applied (or invoked) either from the Profiles page or from the home screen by creating shortcuts. There are also some presets which consist of debloating profiles taken from Universal Android Debloater.
- Exporting rules and applying permissions are not currently working.
- Profiles are applied for all users.
B.1.2 The Interceptor
Intent Intercept works as a man-in-the-middle between source and destination, that is, when you open a file or URL with another app, you can see what is being shared by opening it with Interceptor first. You can also add or modify the intents before sending them to the destination. Additionally, you can double-click on any exportable activities in the Activities tab in the App Details page to open them in the Interceptor to add more configurations.
Known limitation Editing extras is not currently possible.
B.1.3 UnAPKM: DeDRM the APKM files
When I released a small tool called UnAPKM, I promised that similar feature will be available in App Manager. I am proud to announce that you can open APKM files directly in the App Info page or convert them to APKS or install them directly.
B.1.4 Multiple user
App manager now supports multiple users! For now, this requires root or ADB. But no-root support is also being considered. If you have multiple users enabled and click on an app installed in multiple profiles, an alert prompt will be displayed where you can select the user.
B.1.5 Vive la France!
Thanks to the contributors, we have one more addition to the language club: French. You can add more languages or improve existing translations at Weblate.
B.1.6 Report crashes
If App Manager crashes, you can now easily report the crash from the notifications which opens the share options. Crashes are not reported by App Manager, it only redirects you to your favourite Email client.
B.1.7 Android 11
Added support for Android 11. Not everything may work as expected though.
B.1.8 App Installer Improvements
B.1.8.1 Set installation locations
In settings page, you can set install locations such as auto (default), internal only and prefer external.
B.1.8.2 Set APK installer
In settings page, you can also set default APK installer (root/ADB only) instead of App Manager.
B.1.8.3 Multiple users
In settings page, you can allow App Manager to display multiple users during APK installation.
B.1.8.4 Signing APK files
In settings page, you can choose to sign APK files before installing them. You can also select which signature scheme to use in the APK signing option in settings.
Known limitation Currently, only a generic key is used to sign APK files
B.2 v2.5.17 (368)
B.2.1 App Installer
As promised, it is now possible to select splits. AM also provides recommendations based on device configurations. If the app is already installed, recommendations are provided based on the installed app. It is also possible to downgrade to a lower version without data loss if the device has root or ADB. But it should be noted that not all app can be downgraded. Installer is also improved to speed up the installation process, especially, for root users. If the app has already been installed and the new (x)apk(s) is newer or older or the same version with a different signature, AM will display a list of changes similar to What’s New before prompting the user to install the app. This is useful if the app has introduced tracker components, new permissions, etc.
- Large app can take a long time to fetch app info and therefore it may take a long time display the installation prompt.
- If the apk is not located in the internal storage, the app has to be cached first which might also take a long time depending on the size of the apk.
B.2.2 Scanner: Replacement for Exodus Page
Exodus page is now replaced with scanner page. Scanner page contains not only a list of trackers but also a list of used libraries. This is just a start. In the future, this page will contain more in depth analysis of the app.
B.2.3 Introducing System Config
System Config lists various system configurations and whitelists/blacklists included in Android by either OEM/vendor, AOSP or even some Magisk modules. Root users can access this option from the overflow menu in the main page. There isn’t any official documentation for these options therefore it’s difficult to write a complete documentation for this page. I will gradually add documentations using my own knowledge. However, some functions should be understandable by their name.
B.2.4 More Languages
Thanks to the contributors, AM now has more than 12 languages. New languages include Bengali, Hindi, Norwegian, Polish, Russian, Simplified Chinese, Turkish and Ukrainian.
B.2.5 App Info Tab
More tags are added in the app info tab such as KeyStore (apps with KeyStore items), Systemless app (apps installed via Magisk), Running (apps that are running). For external apk, two more options are added namely Reinstall and Downgrade. Now it is possible to share an apk via Bluetooth. For system apps, it is possible to uninstall updates for root/ADB users. But like the similar option in the system settings, this operation will clear all app data. As stated above, exodus has been replaced with scanner.
B.2.6 Navigation Improvements
It’s now relatively easy to navigate to various UI components using keyboard. You can use up/down button to navigate between list items and tab button to navigate to UI components inside an item.
B.2.7 Running Apps Page
It is now possible to sort and filter processes in this tab. Also, the three big buttons are replaced with an easy-to-use three dot menu. Previously the memory usage was wrong which is fixed in this version.
B.2.8 Built-in Toybox
Toybox (an alternative to busybox) is bundled with AM. Although Android has this utility built-in from API 23, toybox is bundled in order to prevent buggy implementations and to support API < 23.
B.2.9 Component Blocker Improvements
Component blocker seemed to be problematic in the previous version, especially when global component blocking is enabled. The issues are mostly fixed now.
Caution. The component blocking mechanism is no longer compatible with v2.5.6 due to various security issues. If you have this version, upgrade to v2.5.13 or earlier versions first. After that, enable global component blocking and disable it again.
B.2.10 Improvements in the App Details Page
Value of various app ops depend on their parent app ops. Therefore, when you allow/deny an app op, the parent of the app op gets modified. This fixes the issues some users have been complaining regarding some app ops that couldn’t be changed.
If an app has the target API 23 or less, its permissions cannot be modified using the pm grant … command. Therefore, for such apps, option to toggle permission has been disabled.
The signature tab is improved to support localization. It also displays multiple checksums for a signature.
B.2.11 App Manifest
Manifest no longer crashes if the size of the manifest is too long. Generated manifest are now more accurate than before.
B.3 v2.5.13 (348)
B.3.1 Bundled App (Split APK)
Bundled app formats such as apks and xapk are now supported. You can install these apps using the regular installation buttons. For root and adb users, apps are installed using shell, and for non-root users, the platform default method is used.
- Currently all splits apks are installed. But this behaviour is going to change in the next release. If you only need a few splits instead of all, extract the APKS or XAPK file, and then, create a new zip file with your desired split apks and replace the ZIP extension with APKS. Now, open it with AM.
- There is no progress dialog to display the installation progress.
B.3.2 Direct Install Support
You can now install APK, APKS or XAPK directly from your favourite browser or file manager. For apps that need updates, a What’s New dialog is displayed showing the changes in the new version.
- Downgrade is not yet possible.
- There is no progress dialog to display the installation progress. If you cannot interact with the current page, wait until the installation is finished.
B.3.3 Remove All Blocking Rules
In the Settings page, a new option is added which can be used to remove all blocking rules configured within App Manager.
B.3.4 App Ops
- App Ops are now generated using a technique similar to AppOpsX. This should decrease the loading time significantly in the App Ops tab.
- In the App Ops tab, a menu item is added which can be used to list only active app ops without including the default app ops. The preference is saved in the shared preferences.
Known Limitation Often the App Ops tab may not be responsive. If that’s the case, restart App Manager.
B.3.5 Enhanced ADB Support
ADB shell commands are now executed using a technique similar to AppOpsX (This is the free alternative of AppOps by Rikka.). This should dramatically increase the execution time.
Known Limitation AM can often crash or become not responsive. If that’s the case, restart App Manager.
B.3.6 Filtering in Main Page
Add an option to filter apps that has at least one activity.
B.3.7 Apk Backup/Sharing
Apk files are now saved as app name_version.extension instead of package.name.extension.
B.3.8 Batch Ops
- Added a foreground service to run batch operations. The result of the operation is displayed in a notification. If an operation has failed for some packages, clicking on the notification will open a dialog box listing the failed packages. There is also a Try Again button on the bottom which can be used to perform the operation again for the failed packages.
- Replaced Linux kill with force-stop.
B.3.9 Translations
Added German and Portuguese (Brazilian) translations.
Known Limitation Not all translations are verified yet.
B.3.10 App Data Backup
Install app only for the current user at the time of restoring backups. Support for split apks is also added.
Data backup feature is now considered unstable. If you encounter any problem, please report to me without hesitation.
Appendix C
App Ops
C.1 Background
App Ops (short hand for Application Operations) are used by Android system (since Android 4.3) to control application permissions. The user can control some permissions, but only the permissions that are considered dangerous (and Google thinks knowing your phone number isn’t a dangerous thing). So, app ops seems to be the one we need if we want to install apps like Facebook and it’s Messenger (the latter literary records everything if you live outside the EU) and still want some privacy and/or security. Although certain features of app ops were available in Settings and later in hidden settings in older version of Android, it’s completely hidden in newer versions of Android and is continued to be kept hidden. Now, any app with android.Manifest.permission.GET_APP_OPS_STATS permission can get the app ops information for other applications but this permission is hidden from users and can only be enabled using ADB or root. Still, the app with this permission cannot grant or revoke permissions (actually mode of operation) for apps other than itself (with limited capacity, of course). To modify the ops of other app, the app needs android.Manifest.permission.UPDATE_APP_OPS_STATS permissions which isn’t accessible via pm command. So, you cannot grant it via root or ADB, the permission is only granted to the system apps. There are very few apps who support disabling permissions via app ops. The best one to my knowledge is AppOpsX. The main (visible) difference between my app (AppManager) and this app is that the latter also provides you the ability to revoke internet permissions (by writing ip tables). One crucial problem that I faced during the development of the app ops API is the lack of documentation in English language.
C.2 Introduction to App Ops
Figure C.0 describes the process of changing and processing permission. AppOpsManager can be used to manage permissions in Settings app. AppOpsManager is also useful in determining if a certain permission (or operation) is granted to the application. Most of the methods of AppOpsManager are accessible to the user app but unlike a system app, it can only be used to check permissions for any app or for the app itself and start or terminating certain operations. Moreover, not all operations are actually accessible from this Java class. AppOpsManager holds all the necessary constants such as OP_*, OPSTR_*, MODE_* which describes operation code, operation string and mode of operations respectively. It also holds necessary data structures such as PackageOps and OpEntry. PackageOps holds OpEntry for a package, and OpEntry, as the name suggests, describes each operation.
AppOpService is completely hidden from a user application but accessible to the system applications. As it can be seen in Figure C.0, this is the class that does the actual management stuff. It contains data structures such as Ops to store basic package info and Op which is similar to OpEntry of AppOpsManager. It also has Shell which is actually the source code of the appops command line tool. It writes configurations to or read configurations from /data/system/appops.xml. System services calls AppOpsService to find out what an application is allowed and what is not allowed to perform, and AppOpsService determines these permissions by parsing /data/system/appops.xml. If no custom values are present in appops.xml, it returns the default mode available in AppOpsManager.
C.3 AppOpsManager
AppOpsManager stands for application operations manager. It consists of various constants and classes to modify app operations.
See also: AppOpsManager documentation
C.3.1 OP_* Constants
OP_* are the integer constants starting from 0. OP_NONE implies that no operations are specified whereas _NUM_OP denotes the number of operations defined in OP_* prefix. While they denote each operation, the operations are not necessarily unique. In fact, there are many operations that are actually a single operation denoted by multiple OP_* constant (possibly for future use). Vendors may define their own op based on their requirements. MIUI is one of the vendors who are known to do that.
public static final int OP_COARSE_LOCATION = 0;
public static final int OP_FINE_LOCATION = 1;
public static final int OP_GPS = 2;
public static final int OP_VIBRATE = 3;
...
public static final int OP_READ_DEVICE_IDENTIFIERS = 89;
public static final int OP_ACCESS_MEDIA_LOCATION = 90;
public static final int OP_ACTIVATE_PLATFORM_VPN = 91;
public static final int _NUM_OP = 92;
Whether an operation is unique is defined by sOpToSwitch. It maps each operation to another operation or to itself (if it’s a unique operation). For instance, OP_FINE_LOCATION and OP_GPS are mapped to OP_COARSE_LOCATION.
Each operation has a private name which are described by sOpNames. These names are usually the same names as the constants without the OP_ prefix. Some operations have public names as well which are described by sOpToString. For instance, OP_COARSE_LOCATION has the public name android:coarse_location.
As a gradual process of moving permissions to app ops, there are already many permissions that are defined under some operations. These permissions are mapped in sOpPerms. For example, the permission android.Manifest.permission.ACCESS_COARSE_LOCATION is mapped to OP_COARSE_LOCATION. Some operations may not have any associated permissions which have null values.
As described in the previous section, operations that are configured for an app are stored at /data/system/appops.xml. If an operation is not configured, then whether system will allow that operation is determined from sOpDefaultMode. It lists the default mode for each operation.
C.3.2 MODE_* Constants
MODE_* constants also integer constants starting from 0. These constants are assigned to each operation describing whether an app is authorised to perform that operation. These modes usually have associated names such as allow for MODE_ALLOWED, ignore for MODE_IGNORED, deny for MODE_ERRORED (a rather misnomer), default for MODE_DEFAULT and foreground for MODE_FOREGROUND.
- MODE_ALLOWED. The app is allowed to perform the given operation
- MODE_IGNORED. The app is not allowed to perform the given operation, and any attempt to perform the operation should silently fail, i.e. it should not cause the app to crash
- MODE_ERRORED. The app is not allowed to perform the given operation, and this attempt should cause it to have a fatal error, typically a SecurityException
- MODE_DEFAULT. The app should use its default security check, specified in AppOpsManager
- MODE_FOREGROUND. Special mode that means “allow only when app is in foreground.” This mode was added in Android 10
- MODE_ASK. This is a custom mode used by MIUI whose uses are unknown.
C.3.3 PackageOps
AppOpsManager.PackageOps is a data structure to store all the OpEntry for a package. In simple terms, it stores all the customised operations for a package.
private final String mPackageName;
private final int mUid;
private final List<OpEntry> mEntries;
...
}
As can be seen in Listing 2, it stores all OpEntry for a package as well as the corresponding package name and its kernel user ID.
C.3.4 OpEntry
AppOpsManager.OpEntry is a data structure that stores a single operation for any package.
private final int mOp;
private final boolean mRunning;
private final @Mode int mMode;
private final @Nullable LongSparseLongArray mAccessTimes;
private final @Nullable LongSparseLongArray mRejectTimes;
private final @Nullable LongSparseLongArray mDurations;
private final @Nullable LongSparseLongArray mProxyUids;
private final @Nullable LongSparseArray<String> mProxyPackageNames;
...
}
Here:
- mOp: Denotes one of the OP_* constants
- mRunning: Whether the operation is in progress (i.e. the operation has started but not finished yet). Not all operations can be started or finished this way
- mMOde: One of the MODE_* constants
- mAccessTimes: Stores all the available access times
- mRejectTimes: Stores all the available reject times
- mDurations: All available access durations, checking this with mRunning will tell you for how long the app is performing a certain app operation
- mProxyUids: No documentation found
- mProxyPackageNames: No documentation found
C.3.5 Usage
TODO
C.4 AppOpsService
TODO
C.5 appops.xml
Latest appops.xml has the following format: (This DTD is made by me and by no means perfect, has compatibility issues.)
<!ELEMENT app-ops (uid|pkg)*>
<!ATTLIST app-ops v CDATA #IMPLIED>
<!ELEMENT uid (op)*>
<!ATTLIST uid n CDATA #REQUIRED>
<!ELEMENT pkg (uid)*>
<!ATTLIST pkg n CDATA #REQUIRED>
<!ELEMENT uid (op)*>
<!ATTLIST uid
n CDATA #REQUIRED
p CDATA #IMPLIED>
<!ELEMENT op (st)*>
<!ATTLIST op
n CDATA #REQUIRED
m CDATA #REQUIRED>
<!ELEMENT st EMPTY>
<!ATTLIST st
n CDATA #REQUIRED
t CDATA #IMPLIED
r CDATA #IMPLIED
d CDATA #IMPLIED
pp CDATA #IMPLIED
pu CDATA #IMPLIED>
]>
The instruction below follows the exact order given above:
- app-ops: The root element. It can contain any number of pkg or package uid
- v: (optional, integer) The version number (default: NO_VERSION or -1)
- pkg: Stores package info. It can contain any number of uid
- n: (required, string) Name of the package
- Package uid: Stores package or packages info
- n: (required, integer) The user ID
- uid: The package user ID. It can contain any number of op
- n: (required, integer) The user ID
- p: (optional, boolean) Is the app is a private/system app
- op: The operation, can contain st or nothing at all
- n: (required, integer) The op name in integer, i.e. AppOpsManager.OP_*
- m: (required, integer) The op mode, i.e. AppOpsManager.MODE_*
- st: State of operation: whether the operation is accessed, rejected or running (not available on old versions)
- n: (required, long) Key containing flags and uid
- t: (optional, long) Access time (default: 0)
- r: (optional, long) Reject time (default: 0)
- d: (optional, long) Access duration (default: 0)
- pp: (optional, string) Proxy package name
- pu: (optional, integer) Proxy package uid
This definition can be found at AppOpsService.
C.6 Command Line Interface
appops or cmd appops (on latest versions) can be accessible via ADB or root. This is an easier method to get or update any operation for a package (provided the package name is known). The help page of this command is self-explanatory:
help
Print this help text.
start [--user <USER_ID>] <PACKAGE | UID> <OP>
Starts a given operation for a particular application.
stop [--user <USER_ID>] <PACKAGE | UID> <OP>
Stops a given operation for a particular application.
set [--user <USER_ID>] <[--uid] PACKAGE | UID> <OP> <MODE>
Set the mode for a particular application and operation.
get [--user <USER_ID>] <PACKAGE | UID> [<OP>]
Return the mode for a particular application and optional operation.
query-op [--user <USER_ID>] <OP> [<MODE>]
Print all packages that currently have the given op in the given mode.
reset [--user <USER_ID>] [<PACKAGE>]
Reset the given application or all applications to default modes.
write-settings
Immediately write pending changes to storage.
read-settings
Read the last written settings, replacing current state in RAM.
options:
<PACKAGE> an Android package name or its UID if prefixed by --uid
<OP> an AppOps operation.
<MODE> one of allow, ignore, deny, or default
<USER_ID> the user id under which the package is installed. If --user is not
specified, the current user is assumed.