4.0 CheatDroid is rebuilt from scratch, and a 2.x license carries over. What changed
CheatDroid
  1. Home
  2. For Developers
  3. Exported Activities, Intents and Secrets in Your APK

Exported Activities, Intents and Secrets in Your APK

CheatDroid’s App Inspector lists every activity your manifest declares and starts any of them on a tap. Exported ones start for anyone. On a rooted phone the others start too, because am start run as root doesn’t care about the exported flag.

Debug menus

A cheat screen for QA, a level select, a button that adds 10,000 coins: if the activity is in the release APK, it’s one tap away on a rooted phone. android:exported="false" doesn’t hide it. Put debug screens in the debug source set, so the release build doesn’t contain them at all, and check the merged manifest of the release build rather than the one you wrote.

The same goes for a debug flag that a hidden gesture switches on. If the code is in the build, a prefs editor or a memory write finds the flag.

Intents

The inspector also sends intents and broadcasts with any action and extras, starting from the deep links and actions your manifest declares. Treat every extra that reaches an exported component as untrusted input. A deep link that grants a reward needs the same server check as any other reward, and a broadcast receiver that only your own code should call shouldn’t be exported.

What’s in the APK

Every installed APK can be read by other apps, root or not. CheatDroid reads your BuildConfig constants and searches the APK for API keys, tokens and endpoints. Anything you compiled in is public, BuildConfig.API_SECRET included.

  • Keys that have to ship, Maps or Firebase for example, get restricted in their console to your package name and signing certificate.
  • Keys that can’t be restricted stay on your server, and the app calls your server.
  • A staging URL or a CHEATS_ENABLED constant in BuildConfig is documentation for whoever reads it next.

Debuggable builds

A build with android:debuggable="true" opens its private files to run-as, no root needed. CheatDroid uses exactly that, through Shizuku, to inspect and edit debuggable apps on unrooted phones. Google Play rejects debuggable uploads, so this is about the test builds you hand out as APKs. Testers rarely need a debugger; give them a build without the flag.