如何在没有root访问权限的情况下获取已安装应用的APK？

I'm trying to extract the APK file of an installed Android app WITHOUT root permissions.

我正在尝试提取没有root权限的已安装Android应用的APK文件。

I thought that this was impossible, because all APK files for non-system-apps are located in /data/app, and accessing this folder requires root permission. Then I found that there are numerous apps in the Google Play store that seem to have access to the APK files even on non-rooted devices.

我认为这是不可能的，因为非系统应用程序的所有APK文件都位于/ data / app中，访问此文件夹需要root权限。然后我发现Google Play商店中有很多应用即使在非root设备上也可以访问APK文件。

Can someone tell me how this is possible? Aren't there backup apps which backup the APK files without root?

有人能告诉我这是怎么回事吗？是否有备份应用程序备份没有root的APK文件？

10 个解决方案

#1

Accessing /data/app is possible without root permission; the permissions on that directory are rwxrwx--x. Execute permission on a directory means you can access it, however lack of read permission means you cannot obtain a listing of its contents -- so in order to access it you must know the name of the file that you will be accessing. Android's package manager will tell you the name of the stored apk for a given package.

没有root权限就可以访问/ data / app;该目录的权限是rwxrwx - x。对目录的执行权限意味着您可以访问它，但是缺少读取权限意味着您无法获取其内容的列表 - 因此，为了访问它，您必须知道将要访问的文件的名称。 Android的包管理器将告诉您给定包的存储apk的名称。

To do this from the command line, use adb shell pm list packages to get the list of installed packages and find the desired package.

要从命令行执行此操作，请使用adb shell pm list packages获取已安装软件包的列表并查找所需的软件包。

With the package name, we can get the actual file name and location of the APK using adb shell pm path your-package-name.

使用包名称，我们可以使用adb shell pm path your-package-name获取APK的实际文件名和位置。

And knowing the full directory, we can finally pull the adb using adb pull full/directory/of/the.apk

在了解完整目录后，我们最终可以使用adb pull full / directory / of / the.apk来获取adb

Credit to @tarn for pointing out that under Lollipop, the apk path will be /data/app/your-package-name-1/base.apk

感谢@tarn指出在Lollipop下，apk路径将是/data/app/your-package-name-1/base.apk

#2

Android appends a sequence number to the package name to produce the final APK file name (it's possible that this varies with the version of Android OS). The following sequence of commands works on a non-rooted device:

Android会在程序包名称中附加一个序列号，以生成最终的APK文件名（这可能会因Android OS的版本而异）。以下命令序列适用于非root设备：

1. Get the full path name of the APK file for the desired package.

   获取所需包的APK文件的完整路径名。

   adb shell pm path com.example.someapp
   

   This gives the output as: package:/data/app/com.example.someapp-2.apk.

   这将输出提供为：package：/data/app/com.example.someapp-2.apk。

2. Pull the APK file from the Android device to the development box.

   将APK文件从Android设备拉到开发框。

   adb pull /data/app/com.example.someapp-2.apk
   

#3

You don't need ROOT permissions to get the list of Installed Apps.

您无需ROOT权限即可获取已安装应用程序的列表。

You can do it with android PackageManager.

你可以用android PackageManager来做。

Below is a small code snippet.

以下是一个小代码段。

final PackageManager pm = getPackageManager();
//get a list of installed apps.
List<ApplicationInfo> packages =  pm.getInstalledApplications(PackageManager.GET_META_DATA);

for (ApplicationInfo packageInfo : packages) {
    Log.d(TAG, "Installed package :" + packageInfo.packageName);
    Log.d(TAG, "Apk file path:" + packageInfo.sourceDir);
}

#4

When you have Eclipse for Android developement installed:

当您安装Eclipse for Android开发时：

• Use your device as debugging device. On your phone: Settings > Applications > Development and enable USB debugging, see http://developer.android.com/tools/device.html
• 将您的设备用作调试设备。在手机上：设置>应用程序>开发并启用USB调试，请参阅http://developer.android.com/tools/device.html
• In Eclipse, open DDMS-window: Window > Open Perspective > Other... > DDMS, see http://developer.android.com/tools/debugging/ddms.html
• 在Eclipse中，打开DDMS窗口：Window> Open Perspective> Other ...> DDMS，请参阅http://developer.android.com/tools/debugging/ddms.html
• If you can't see your device try (re)installing USB-Driver for your device
• 如果您看不到您的设备，请尝试（重新）为您的设备安装USB驱动程序
• In middle pane select tab "File Explorer" and go to system > app
• 在中间窗格中，选择“文件资源管理器”选项卡，然后转到系统>应用
• Now you can select one or more files and then click the "Pull a file from the device" icon at the top (right to the tabs)
• 现在您可以选择一个或多个文件，然后单击顶部的“从设备中提取文件”图标（右侧的选项卡）
• Select target folder - tada!
• 选择目标文件夹 - tada！

#5

1. check the list of installed apk's (following command also list the path where it is installed and package name). adb shell pm list packages -f
2. 检查已安装apk的列表（以下命令还列出了安装它的路径和包名称）。 adb shell pm list packages -f
3. use adb pull /package_path/package name /path_in_pc (package path and package name one can get from above command 1.)
4. 使用adb pull / package_path / package name / path_in_pc（可以从上面的命令1获得的包路径和包名）

#6

On Nougat(7.0) Android version run adb shell pm list packages to list the packages installed on the device. Then run adb shell pm path your-package-name to show the path of the apk. After use adb to copy the package to Downloads adb shell cp /data/app/com.test-1/base.apk /storage/emulated/0/Download. Then pull the apk from Downloads to your machine by running adb pull /storage/emulated/0/Download/base.apk.

在Nougat（7.0）Android版本上运行adb shell pm list packages列出设备上安装的软件包。然后运行adb shell pm path your-package-name来显示apk的路径。使用adb后将软件包复制到下载adb​​ shell cp /data/app/com.test-1/base.apk / storage / emulated / 0 / Download。然后通过运行adb pull /storage/emulated/0/Download/base.apk将apk从下载中拉到您的计算机。

#7

List PackageManager.getInstalledApplications() will give you a list of the installed applications, and ApplicationInfo.sourceDir is the path to the .apk file.

List PackageManager.getInstalledApplications（）将为您提供已安装应用程序的列表，ApplicationInfo.sourceDir是.apk文件的路径。

// in oncreate
   PackageManager pm = getPackageManager(); 
   for (ApplicationInfo app : pm.getInstalledApplications(0)) {
 Log.d("PackageList", "package: " + app.packageName + ", sourceDir: " + app.sourceDir);
 }

//output is something like
D/PackageList(5010): package: com.example.xmlparse, sourceDir: /data/app   /com.example.xmlparse-2.apk
D/PackageList(5010): package: com.examples.android.calendar, sourceDir: /data/app/com.examples.android.calendar-2.apk
D/PackageList(5010): package: com.facebook.katana, sourceDir: /data/app/com.facebook.katana-1.apk
D/PackageList(5010): package: com.facebook.samples.profilepicture, sourceDir: /data/app/com.facebook.samples.profilepicture-1.apk
D/PackageList(5010): package: com.facebook.samples.sessionlogin, sourceDir: /data/app/com.facebook.samples.sessionlogin-1.apk
D/PackageList(5010): package: com.fitworld, sourceDir: /data/app/com.fitworld-2.apk
D/PackageList(5010): package: com.flipkart.android, sourceDir: /data/app/com.flipkart.android-1.apk
D/PackageList(5010): package: com.fmm.dm, sourceDir: /system/app/FmmDM.apk
D/PackageList(5010): package: com.fmm.ds, sourceDir: /system/app/FmmDS.apk

#8

I found a way to get the APK's package name in a non-root device. it's not so elegant, but works all the time.

我找到了一种在非root设备中获取APK包名称的方法。它不是那么优雅，但总是有效。

Step 1: on your device, open the target APK

第1步：在您的设备上，打开目标APK

Step 2: on PC cmd window, type this commands:

步骤2：在PC cmd窗口中，键入以下命令：

 adb shell dumpsys activity a > dump.txt

because the output of this command is numerous, redirect to a file is recommended.

因为此命令的输出很多，建议重定向到文件。

Step 3: open this dump.txt file with any editor.

第3步：使用任何编辑器打开此dump.txt文件。

for device befor Android 4.4:
the beginning of the file would be looked like this:

对于Android 4.4的设备：文件的开头看起来像这样：

ACTIVITY MANAGER ACTIVITIES (dumpsys activity activities)  
  Main stack:  
  * TaskRecord{41aa9ed0 #4 A com.tencent.mm U 0}  
    numActivities=1 rootWasReset=true userId=0  
    affinity=com.tencent.mm  
    intent={act=android.intent.action.MAIN cat=[android.intent.category.LAUNCHER] flg=0x10600000 cmp=com.tencent.mm/.ui.LauncherUI}  
    realActivity=com.tencent.mm/.ui.LauncherUI  
    askedCompatMode=false  
    lastThumbnail=null lastDescription=null  
    lastActiveTime=19915965 (inactive for 10s)  
    * Hist #9: ActivityRecord{41ba1a30 u0 com.tencent.mm/.ui.LauncherUI}  
        packageName=com.tencent.mm processName=com.tencent.mm 

the package name is in the 3rd line, com.tencent.mm for this example.

包名称在第3行，com.tencent.mm为此示例。

for Android 4.4 and later:
the dumpsys output has changed a little. try search "Stack #1", the package name would be very close below it.

对于Android 4.4及更高版本：dumpsys输出已经改变了一点。尝试搜索“堆栈＃1”，包名称将非常接近它。

Also, search "baseDir", you will find the full path of the apk file!

另外，搜索“baseDir”，你会发现apk文件的完整路径！

#9

Open ES explorer -> push Menu button at the left upper corner (three horizontal stripes) -> in the Libraries section choose APPs.

打开ES资源管理器 - >按左上角的菜单按钮（三个水平条纹） - >在库部分选择APP。

Thus, you get the list of all the user apps. Find your app and select it with long pushing on it. Then press "More" in the right low corner and choose "Send". Then you can use different options, e.g. you can choose "ES Save To" in order to save the .apk file to your home directory or anywhere else.

因此，您将获得所有用户应用程序的列表。找到你的应用程序，并长时间推选它。然后在右下角按“更多”并选择“发送”。然后你可以使用不同的选项，例如您可以选择“ES保存到”以将.apk文件保存到您的主目录或其他任何位置。

#10

Or you can get 'Bluetooth File Transfer' from Google Play and set the home folder to /system/ . Then you can even go to / .

或者您可以从Google Play获取“蓝牙文件传输”并将主文件夹设置为/ system /。然后你甚至可以去/。