Sep 15, 2009

How to get EMMA code coverage of Android

Here are some basic steps How to get Emma code coverage of Android.

Thanks to Brett Chabot and Gabor for useful support at Android Developer Group

Before doing these steps, you need to get full source code of Android (follow this link for more details )

After that, go to root folder of Android source code and do extractly this instruction below.

A. Generating code coverage using runtest script

1. Firstly, you need to add the target system/framework/emma.jar to the device's boot classpath. So that, modify the BOOTCLASSPATH variable in /system/core/rootdir/init.rc .

a. Open /system/core/rootdir/init.rc

b. The system/framework/emma.jar entry needs to be added in the exact position shown below:
export BOOTCLASSPATH=/system/framework/core.jar:/system/framework/ext.jar:/system/framework/emma.jar:/system/framework/framework.jar:/system/framework/android.policy.jar:/system/framework/services.jar

c. Save and close init.rc file

2. Since EMMA will save the coverage result into SDCard, you need to ensure that the SDCard can be mounted properly. So that,

a. Open this file: build/core/

b. Ensure that these lines have already added (around line number 212 to 219), if not, do it by yourself!
# Install a vold.conf file is one's not already being installed.
ifeq (,$(filter %:system/etc/vold.conf, $(PRODUCT_COPY_FILES)))
ifeq ($(filter eng tests,$(TARGET_BUILD_VARIANT)),)
$(warning implicitly installing vold.conf)

(Please follow this link for more details )

3. Build the bootimage to pick up the init.rc changes
make bootimage

4. Build a full system image
make -j4

5. Make EMMA

make emma

6. Start emulator
[path_to_SDK_tools]/emulator -sdcard [path_to_your_sdcard]

7. Next, use the script. Runtest will do all the necessary steps to instrument your test and target package, run the test, and generate the code coverage report.
cd [path_to_android_source_code]

python development/testrunner/ --coverage [Test_package]

[Test_package] can be: apidemos, core, music, email... (Leave this option null to see the list).

8. After finish this script, the coverage report will be generated and saved into


folder. You can find a html report of EMMA code coverage for [Test_package] there.


B. Generating code coverage for your own test

If you want to running code coverage for your own test, please follow steps as described above, but skip step 6 to 8, continue with step 9 (after step 5) shown below:

9. Setting the environment and additional bash commands. (like m,mm,mmm, choosecombo etc) Notice the space after the dot!
. build/

10. Set the ANDROID_PRODUCT_OUT directory for the emulator to know the image location
export ANDROID_PRODUCT_OUT=[path_to_Android_source_code]/out/target/product/generic

This step is important. The emulator will know where are the images it need to be synchronized with.


12. Compile the Application would like to instrument
mmm development/samples/[your_project]

(You can use apidemos for example)

After run this step, new images can be generated and saved into ANDROID_PRODUCT_OUT (in step 10)

13. Run emulator
[path_to_SDK_tools]/emulator -sdcard [path_to_your_sdcard]

14. Remount the drive - it is needed to have a writable drive. without that sync wont work
adb remount

15. Synchronize the local content (new images) with the emulator
adb sync

16. Run instrumentation
adb shell am instrument -w -e coverage true [source_code_of_test]

Here is example for apidemos
adb shell am instrument -w -e coverage true

See this for more details of InstrumentationTestRunner options.

17. This command will dump a runtime coverage data file at /sdcard/ on the device.

Extract it to local host
adb pull /sdcard/

18. Now generate a coverage report. You'll need to pass in the path to the coverage metadata generated at build time.
java -cp external/emma/lib/emma.jar emma report -r html -in -sp [path_to_your_project_source_code] -in out/target/common/obj/APPS/[your_project]_intermediates/coverage.em

Here is example for apidemos:
java -cp external/emma/lib/emma.jar emma report -r html -in -sp development/samples/ApiDemos/src -in out/target/common/obj/APPS/ApiDemos_intermediates/coverage.em

19. Now, you will get the HTML report of EMMA code coverage for your own project.

Check it out!

Notes: In the first time running instrumentation (step 7 or 16) the Android system may be crashed. But, don't worry, it will automatically restart. Then, you can run the instrumentation again successfully!

How to set proxy for Android (updated for 1.5 and 1.6_r1 versions)

Here is a tutorial to reconfigure settings of Android , to use proxy for Internet connections.
Basically, we need to modify content of settings.db file in /data/data/ of Android.

So, we can follow these steps:

1. Go into SDK tools folder
cd [path_to_SDK_folder]/tools
then start emulator.

2. Get settings.db file from Android:
adb pull /data/data/ settings.db
3. Use SQLite3 to modify it:

a. If you are using Android SDK version 1.1 or lower,
then use:
sqlite3 settings.db "INSERT INTO system VALUES(99,'http_proxy','[proxy_host]:[proxy_port]');"
b. If you are using Android SDK version 1.5 or higher
then use:
sqlite3 settings.db "INSERT INTO secure (name, value) VALUES('http_proxy','[proxy_host]:[proxy_port]');"
4. Put it back into Android:
adb push settings.db /data/data/
5. Restart emulator. Then we can use proxy setting for Internet connections.

Lotus Notes: This database cannot be read due to an invalid on disk structure

Error message: "This database cannot be read due to an invalid on disk structure".

How to fix it?

1. Open Workspace by clicking icon on the left side
2. Right click to Email Icon (Local) on Workspace --> "Remove From Workspace"
3. Right click to Email Icon (Server) again--> "Replication" --> "New Replica..."
4. Select a new file or replace the old one to replicate database from server to local
5. Waiting...
6. When replicating finished --> Have fun!

ph0wn CTF 2017 Write-up: Misc/helpxman - Stage 2 and 3

After successfully getting the flag of  Stage 1 , the challenge told us to continue looking for something interesthing from the app. After ...