search

facebookarchive / stetho

Stetho is a debug bridge for Android applications, enabling the powerful Chrome Developer Tools and much more.
http://facebook.github.io/stetho/
MIT License
12.66k stars 1.13k forks source link

Does it has to be invoked in application.onCreate()? #630

Closed H4oK3 closed 5 years ago

H4oK3 commented 5 years ago

Hey, I would like to ask does Stetho.initializeWithDefaults(this) has to be invoked within application.onCreate()? I am a security researcher and using stetho for reverse engineering; I tried to invoke initializeWithDefaults(context) at some point after the activity has been rendered; and I only got <com.foo.bar.myapp></com.foo.bar.myapp> dumped with nothing inside. I assume this initializeWithDefaults has to be invoked no later than certain point so it can work well.

longinoa commented 5 years ago

What happens if you rotate the screen? I am assuming this is due to how the activity is loaded.

jasta commented 5 years ago

@H4oK3 hmm, not really sure what you're really after. Older versions of Android don't automatically detect activity transitions so you can end up only seeing the screens that were added after you attached. On newer Android versions though this isn't an issue since we use the global activity lifecycle listener (which we install eagerly during Stetho initialization and as an aside it's one of the only things we init eagerly).

If you're concerned about the security of Stetho I can speak pretty confidently to the design choices we made and why I'm confident that installing it on app create unconditionally is the right choice. Only a device with adb shell access will work and if your app configuration is in debug mode then already adb shell run-as would be possible so any notion of security from the connected peer's point of view is out the window.