Native code debugging

hello-gos

What can an app do (in worst case) if native code debugging is enabled?

I have an app that after an upgrade started crashing on startup. With the latest version it only works if you allow native code debugging. This app has existed for a long time and never needed this before.

Is it worth getting an old version of the app from apk pure or apk mirror instead?

Watermelon

hello-gos What can an app do (in worst case) if native code debugging is enabled?

Here is a comment from Daniel Mickay:
https://github.com/GrapheneOS/os-issue-tracker/issues/651#issuecomment-917599928

hello-gos I have an app that after an upgrade started crashing on startup. With the latest version it only works if you allow native code debugging. This app has existed for a long time and never needed this before.

Block native code debugging, open the app, and when you get the notification, tap on more info. Do you see libpairipcore.so by any chance?

hello-gos Is it worth getting an old version of the app from apk pure or apk mirror instead?

Probably not. The older version could be insecure, you'll have to uninstall the app and lose all app data in order to downgrade it, and you might accidentally download a tampered version of the app because the OS wouldn't recognize the app signature because it's not installed anymore.

APKPure is extremely low quality. APKMirror is probably the least risky APK site, I'd say.

hello-gos

Watermelon the app has a local backup and restore feature which I use to avoid loosing my data.

Watermelon Block native code debugging, open the app, and when you get the notification, tap on more info. Do you see libpairipcore.so by any chance?

Yes, it looks like libpairipcore.so is the issue: split_config.arm64_v8a.apk!libpairipcore.so (offset 0x8000).

Is that good or bad?

Watermelon

hello-gos libpairipcore.so is a Google library. It tries to do native code debugging as an “anti reverse engineering” method. It's part of the Google Play Integrity services, although it's different from the well known Play Integrity API. I believe it's enabled by the “automatic protection” feature in the app developer's Google Play console. They probably enabled it, although lately I've grown suspicious that maybe Google is randomly turning this on for some apps. You can try asking the app developer to turn it off.

hello-gos

Watermelon i can try but it's a big app with millions of downloads so will probably be hard to get them to change.

Could that lib have any bad effect? The app itself only has notification privs granted, i.e. no network or storage etc.

Watermelon

hello-gos It depends. Do you trust Google? To what extent do you trust Google? It also forces you to disable the protection for the entire app, not just Google's library inside it. Daniel Mickay says that native code debugging only slightly increases risk, so maybe you don't have to care about it so much. Or maybe you want to feel more secure :)

But anyway, you should at least ask the app developer if they turned on the “automatic protection” feature, or if it got turned on without their consent, or maybe it's not this feature that causes this Google library to be added? It's worth investigating this issue.