An interactive Go CLI that pulls an installed app's base APK off a connected
Android device and dumps its merged AndroidManifest.xml — to verify what
actually shipped (embedded API keys, permissions, meta-data) vs. what the source
tree says.
adb(platform-tools) onPATH- Android SDK build-tools (for
aapt2) — auto-detected under$ANDROID_HOME,$ANDROID_SDK_ROOT, or~/Library/Android/sdk - A device connected with USB debugging enabled
go build -o android-manifest-puller ../android-manifest-puller- Pick a device — shown by friendly name (e.g.
Google Pixel 7 — 38071FDJG007QW) where the device reports one. Skipped automatically if only one is attached, or pass-s <serial>. - Pick a package — a filterable list of everything installed:
- Start typing to narrow it down (
/-style fuzzy filter). - The app's display name is resolved lazily under the package id when you pause on a row.
- Press
xto exclude namespaces — enter comma-separated prefixes likecom.google, com.samsungto hide those packages (com.google.*works too).escback to devices (when you picked one), or quit.
- Start typing to narrow it down (
- Read the manifest — the manifest is reformatted into clean, indented XML
(namespace URIs collapsed to their prefix, resource-id hex dropped). Type to
live-filter (case-insensitive, with surrounding context, like
grep -B1 -A2);↑/↓to scroll;escto go back to the package picker.
# Dump filtered to stdout (implies non-interactive)
./android-manifest-puller -p com.ceofficesolutions.zuwa -g API_KEY
# Full manifest to stdout
./android-manifest-puller -p com.ceofficesolutions.zuwa --plain
# Positional args (compatible with the old shell script)
./android-manifest-puller com.ceofficesolutions.zuwa API_KEY| Flag | Description |
|---|---|
-p, --package |
Package name to dump (skips the picker) |
-g, --grep |
Case-insensitive filter with context (implies non-interactive) |
-s, --serial |
Device serial (skips the device picker) |
--plain |
Print to stdout without the interactive UI |