2

I want get a complete list including all apps (including system apps) that are running in Direct Boot Mode, therefore they necessarily store their data in the DE (Device Encrypted) area (as opposed to CE = Credential Encrypted Area).

Background: As of Android 7, FBE (File-Based Encryption) was introduced as an alternative to FDE (Full-Disk Encryption). Sadly, in Android 10, FDE was removed and everyone is now forced to use FBE.

There are some apps that are considered "essential" and therefore they start-up on boot. As such, information leakage can happen if the phone is booted cold by an attacker. Such apps include:

  1. Telephony-related apps
  2. Alarm apps
  3. Accessibility Services
  4. Keyboard app to enter the passphrase
  5. etc

For a given device, I'd like to get a complete list of all apps that are currently permitted to run in Direct Boot Mode, and I'd like to remove them (Yes, I don't want my alarm to run in Direct Boot Mode. Yes, I don't want to be able to send or recieve calls/messages in Direct Boot Mode)

How can I get a list of all of the apps that are set to start & run in Direct Boot Mode, and whose storage is then necessarily using DE instead of CE?

Improve this question
1
  • 1
    As direct boot aware apps are identified by a manifest entry <application android:directBootAware="true" android:defaultToDeviceProtectedStorage="true"> apps that read AndroidManifest.xml of all installed apps should be able to show which apps have this enabled. Not sure if there is already an app to summarize apps with that setting.
    – Robert
    Jul 4, 2021 at 13:34

1 Answer 1

Reset to default
3

Android apps that can run in direct boot need to be declared in the Android Manifest as android:directBootAware="true"

To get the Manifest XML of an APK apktool can be used. https://ibotpeaches.github.io/Apktool/

You can write a script to achieve your result or else, do it manually.

Use adb and package manager to get a list of packages installed

adb shell pm list packages | sort

Find apk directory

adb shell pm path com.king.candycrushsaga
package:/data/app/com.king.candycrushsaga-1/base.apk

Download the APK

adb pull data/app/com.king.candycrushsaga-1/base.apk

Then use apktool on the output

apktool d base.apk

Then search for android:directBootAware="true" in manifest If it is there, you can remove the APK with adb

https://stackoverflow.com/questions/2507960/does-android-keep-the-apk-files-if-so-where https://stackoverflow.com/questions/4191762/how-to-view-androidmanifest-xml-from-apk-file/54874783#54874783

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .