Host-Device Data Transfer
You can copy files to and from a device by using the adb commands
adb pull <remote> <local> and
adb push <local> <remote> commands. Their usage is very straightforward. For example, the following will copy
foo.txt from your current directory (local) to the
sdcard folder (remote):
adb push foo.txt /sdcard/foo.txt
This approach is commonly used when you know exactly what you want to copy and from/to where and also supports bulk file transfer, e.g. you can pull (copy) a whole directory from the Android device to your host computer.
$ adb pull /sdcard /sdcard/: 1190 files pulled. 14.1 MB/s (304526427 bytes in 20.566s)
Using Android Studio Device File Explorer¶
Android Studio has a built-in Device File Explorer which you can open by going to View -> Tool Windows -> Device File Explorer.
If you're using a rooted device you can now start exploring the whole file system. However, when using a non-rooted device accessing the app sandboxes won't work unless the app is debuggable and even then you are "jailed" within the app sandbox.
This option is useful when you are working on a specific app and want to copy files you might encounter inside its sandbox (notice that you'll only have access to the files that the target app has access to). This approach works without having to set the app as debuggable, which is otherwise required when using Android Studio's Device File Explorer.
First, connect to the app with Objection as explained in "Recommended Tools - Objection". Then, use
cd as you normally would on your terminal to explore the available files:
$ frida-ps -U | grep -i owasp 21228 sg.vp.owasp_mobile.omtg_android $ objection -g sg.vp.owasp_mobile.omtg_android explore ...g.vp.owasp_mobile.omtg_android on (google: 8.1.0) [usb] # cd .. /data/user/0/sg.vp.owasp_mobile.omtg_android ...g.vp.owasp_mobile.omtg_android on (google: 8.1.0) [usb] # ls Type ... Name --------- ... ------------------- Directory ... cache Directory ... code_cache Directory ... lib Directory ... shared_prefs Directory ... files Directory ... app_ACRA-approved Directory ... app_ACRA-unapproved Directory ... databases Readable: True Writable: True
One you have a file you want to download you can just run
file download <some_file>. This will download that file to your working directory. The same way you can upload files using
...[usb] # ls Type ... Name ------ ... ----------------------------------------------- File ... sg.vp.owasp_mobile.omtg_android_preferences.xml Readable: True Writable: True ...[usb] # file download sg.vp.owasp_mobile.omtg_android_preferences.xml Downloading ... Streaming file from device... Writing bytes to destination... Successfully downloaded ... to sg.vp.owasp_mobile.omtg_android_preferences.xml
The downside is that, at the time of this writing, objection does not support bulk file transfer yet, so you're restricted to copy individual files. Still, this can come handy in some scenarios where you're already exploring the app using objection anyway and find some interesting file. Instead of for example taking note of the full path of that file and use
adb pull <path_to_some_file> from a separate terminal, you might just want to directly do
file download <some_file>.