Andure — DevTools for Android Chrome

❗ Andure also works without AdGuard! You can download Bromite Browser and inject Andure's persistent userscript into the browser via the settings. Thanks to @porobertdev who made the discovery.

Based on eruda, andure dynamically injects web-based DevTools into any website through a local VPN tunnel (using AdGuard HTTPS filtering), allowing for inspection and debugging similar to desktop Chromium DevTools.

To start DevTools for a website, simply shake your phone and a prompt will appear.

To install, follow the installation section below.

1-Minute Demo

https://user-images.githubusercontent.com/63468786/142807725-0489edc5-0d50-4245-9d53-7a26079c290c.mov

Visit https://youtu.be/fVCdcvZ7Cv8 if the above video cannot be played.

Features

• Execute JavaScript on page
• Select an element on the page to view its properties
• Inspect incoming and outgoing network requests
• Inspect website source
• Show localStorage, and cookie information
• etc.

See eruda docs for more features.

Installation

1. Download the andure script from this repo and save it on your phone. (For browsers with devicemotion disabled, e.g. Brave, there is another script that shows the DevTools button persistently)
2. Install AdGuard for Android and enable HTTPS filtering.
3. In Settings > Extensions, select + New Extension and locate the above script. Press Add after confirming the extension details are correct.
4. Open a new tab and visit a page. Shake your device to confirm the DevTool prompt shows. (Might need to reload browser or page a few times)

Note: An alternative to AdGuard for script injection is Tampermonkey, but the Android app is no longer actively mantained and hence is NOT recommended.

Limitations

• For websites served on HTTP, DevTools will be initialized automatically on page load since devicemotion is disabled by default on most browsers (and hence device shakes cannot be detected).
• DevTools icons not working for sites with Content Security Policy but without font-src set.
• DevTools will not be injected on financial websites and websites with sensitive personal data. A list of 1300+ exclusions can be seen here.

Future Work

• [ ] Open-source Android app — Script injection currently depends on AdGuard's app - this imposes certain limitations (see above) and is proprietary code. An open-source Android app replaces the need for a third-party app (and simplifies the installation process).

Contributing

Please visit the contributing guidelines and feel free to join our discord server!