Pulling package private files from debug Android applications

Android-7.0 (Nougat, API-24) started protecting package private files from adb shell, meaning it is not possible to just adb pull them.

$ adb pull /data/data/com.viliussutkus89.application/cache
adb: error: remote object '/data/data/com.viliussutkus89.application/cache' does not exist

Debug applications allow users to run programs as them (run-as):

$ adb shell run-as com.viliussutkus89.application pwd

run-as enables reading package private files as the owner application and pulling them out of the device. Storage permission would be needed to copy into /data/local/tmp or any other end-user readable location.


A wrapper to read files as the specified application, pipe them into /data/local/tmp as a regular shell user and adb pull out of the device.

$ adbPullAs com.viliussutkus89.application /data/data/com.viliussutkus89.application/cache/TestScreenshots
/data/local/tmp/adbPullAs/pull/TestScreenshots/: 4 files...lled, 0 skipped. 3.6 MB/s (848005 bytes in 0.226s)

Reminder, this does not work with release applications, only with debug applications.

$ adb shell run-as com.viliussutkus89.released_application pwd
run-as: Package 'com.viliussutkus89.released_application' is not debuggable