Android Native debug (ndk-gdb) on HTC Desire: run-as flaw?

Question

I'm trying to perform native code debug on my HTC Desire for my Android project. The project is made of a thin layer of JNI wrapper and the main chunk in C++, compiled using ndk-build. The debuggable flag is set, I'm running 2.2 on an HTC Desire and I'm working with Ubuntu on my PC.

So a plain ndk-gdb --start returns a:

ERROR: Could not setup network redirection to gdbserver?
   Maybe using --port=<port> to use a different TCP port might help?

This is weird. I checked on the internet and found that it's the wrong message error caused by a flaw in ndk-gdb. If I run ndk-gdb -- start --verbose I obtain this messed up error:

Android NDK installation path: /home/marco/dev/android-ndk
Using specific adb command: /home/marco/dev/android-sdk//platform-tools/adb
ADB version found: Android Debug Bridge version 1.0.26
Using final ADB command: '/home/marco/dev/android-sdk//platform-tools/adb'
Using auto-detected project path: .
Found package name: com.marco83.siege
ABIs targetted by application: armeabi
Device API Level: 8
Device CPU ABIs: armeabi-v7a armeabi
Compatible device ABI: armeabi
Found debuggable flag: true
Found device gdbserver: /data/data/com.marco83.siege/lib/gdbserver
Using gdb setup init: /home/marco/dev/siege_game/trunk/SiegeGameNative/libs/armeabi/gdb.setup
Using toolchain prefix: /home/marco/dev/android-ndk/toolchains/arm-linux-androideabi-4.4.3/prebuilt/linux-x86/bin/arm-linux-androideabi-
Using app out directory: /home/marco/dev/siege_game/trunk/SiegeGameNative/obj/local/armeabi
Found data directory: 'run-as: Package 'com.marco83.siege' has corrupt installation'
Found first launchable activity: .Main
Launching activity: com.marco83.siege/.Main
## COMMAND: /home/marco/dev/android-sdk//platform-tools/adb shell am start -n com.marco83.siege/.Main
Starting: Intent { cmp=com.marco83.siege/.Main }
Warning: Activity not started, its current task has been brought to the front
## COMMAND: /home/marco/dev/android-sdk//platform-tools/adb shell sleep 2
Found running PID: 844
Launched gdbserver succesfully.
Setup network redirection
## COMMAND: /home/marco/dev/android-sdk//platform-tools/adb forward tcp:5039 localfilesystem:run-as: Package 'com.marco83.siege' has corrupt installation/debug-socket
## COMMAND: /home/marco/dev/android-sdk//platform-tools/adb shell run-as com.marco83.siege lib/gdbserver +debug-socket --attach 844
Android Debug Bridge version 1.0.26

 -d                            - directs command to the only connected USB device
                                 returns an error if more than one USB device is present.
 -e                            - directs command to the only running emulator.
                                 returns an error if more than one emulator is running.
 -s <serial number>            - directs command to the USB device or emulator with
                                 the given serial number. Overrides ANDROID_SERIAL
                                 environment variable.
 -p <product name or path>     - simple product name like 'sooner', or
                                 a relative/absolute path to a product
                                 out directory like 'out/target/product/sooner'.
                                 If -p is not specified, the ANDROID_PRODUCT_OUT
                                 environment variable is used, which must
                                 be an absolute path.
 devices                       - list all connected devices
 connect <host>[:<port>]       - connect to a device via TCP/IP
                                 Port 5555 is used by default if no port number is specified.
 disconnect [<host>[:<port>]]  - disconnect from a TCP/IP device.
                                 Port 5555 is used by default if no port number is specified.
                                 Using this ocmmand with no additional arguments
                                 will disconnect from all connected TCP/IP devices.

device commands:
  adb push <local> <remote>    - copy file/dir to device
  adb pull <remote> [<local>]  - copy file/dir from device
  adb sync [ <directory> ]     - copy host->device only if changed
                                 (-l means list but don't copy)
                                 (see 'adb help all')
  adb shell                    - run remote shell interactively
  adb shell <command>          - run remote shell command
  adb emu <command>            - run emulator console command
  adb logcat [ <filter-spec> ] - View device log
  adb forward <local> <remote> - forward socket connections
                                 forward specs are one of: 
                                   tcp:<port>
                                   localabstract:<unix domain socket name>
                                   localreserved:<unix domain socket name>
                                   localfilesystem:<unix domain socket name>
                                   dev:<character device name>
                                   jdwp:<process pid> (remote only)
  adb jdwp                     - list PIDs of processes hosting a JDWP transport
  adb install [-l] [-r] [-s] <file> - push this package file to the device and install it
                                 ('-l' means forward-lock the app)
                                 ('-r' means reinstall the app, keeping its data)
                                 ('-s' means install on SD card instead of internal storage)
  adb uninstall [-k] <package> - remove this app package from the device
                                 ('-k' means keep the data and cache directories)
  adb bugreport                - return all information from the device
                                 that should be included in a bug report.

  adb help                     - show this help message
  adb version                  - show version num

DATAOPTS:
 (no option)                   - don't touch the data partition
  -w                           - wipe the data partition
  -d                           - flash the data partition

scripting:
  adb wait-for-device          - block until device is online
  adb start-server             - ensure that there is a server running
  adb kill-server              - kill the server if it is running
  adb get-state                - prints: offline | bootloader | device
  adb get-serialno             - prints: <serial-number>
  adb status-window            - continuously print device status for a specified device
  adb remount                  - remounts the /system partition on the device read-write
  adb reboot [bootloader|recovery] - reboots the device, optionally into the bootloader or recovery program
  adb reboot-bootloader        - reboots the device into the bootloader
  adb root                     - restarts the adbd daemon with root permissions
  adb usb                      - restarts the adbd daemon listening on USB
  adb tcpip <port>             - restarts the adbd daemon listening on TCP on the specified port
networking:
  adb ppp <tty> [parameters]   - Run PPP over USB.
 Note: you should not automatically start a PPP connection.
 <tty> refers to the tty for PPP stream. Eg. dev:/dev/omap_csmi_tty1
 [parameters] - Eg. defaultroute debug dump local notty usepeerdns

adb sync notes: adb sync [ <directory> ]
  <localdir> can be interpreted in several ways:

  - If <directory> is not specified, both /system and /data partitions will be updated.

  - If it is "system" or "data", only the corresponding partition
    is updated.

environmental variables:
  ADB_TRACE                    - Print debug information. A comma separated list of the following values
                                 1 or all, adb, sockets, packets, rwx, usb, sync, sysdeps, transport, jdwp
  ANDROID_SERIAL               - The serial number to connect to. -s takes priority over this if given.
  ANDROID_LOG_TAGS             - When used with the logcat option, only these debug tags are printed.
ERROR: Could not setup network redirection to gdbserver?
       Maybe using --port=<port> to use a different TCP port might help?
marco@pacer:~/dev/siege_game/trunk/SiegeGameNative$ run-as: Package 'com.marco83.siege' has corrupt installation

which, as you can see and as reported here: http://vilimpoc.org/blog/2010/09/23/hello-gdbserver-a-debuggable-jni-example-for-android/ is caused by a mix of different simultaneous outputs; the real error should be

Package 'xxxxx' has corrupt installation

Further investigation in this error pointed me to: http://osdir.com/ml/android-ndk/2010-08/msg00263.html

where the same error is reported, and they say it's not possible to debug natively on Desire. The problem is with run-as not being able to access the /data folder.

Any solution other than rooting/flashing the phone? Why does the run-as access /data? I was thinking of a naive solution where I copy the package (objs, libs, ...) into an easier accessible location (like on the SDcard) and tell the debugger to access that location instead - is it feasible?

Thanks Marco

EDIT: Update: I rooted the phone using unrevoked3. Even if I set chmod 0777 data (which is probably EXTREMELY dangerous), I get the same error. As reported in the second link in the post, run-as is checking if /data is accessible. How can I access run-as source code? Is it possible to recompile it and upload a modified version that works around this check? (since I can set /data to be readable by everyone anyway)

Answer 1

I fixed this issue for a HTC Desire S (2.3.3) by changing access & ownership for directory '/data/data':

Before the fix:

ls -l /data
 (...)
drwxrwxrwx root     root              2012-03-03 19:07 data

In root mode:

chmod 771 /data/data
chown system.system /data/data

ls -l /data
 (...)
drwxrwx--x system   system            2012-03-03 19:07 data

Also the /data director may need changing.

chmod 771 /data
chown system.system /data

Answer 2

Have same problem with my HTC Legend. My workaround:

1. get root access
2. get PID of app you want to debug: ps | grep your_app_package
3. run gdb server: /data/data/your_app_package/lib/gdbserver :5039 --attach PID

in new terminal

1. adb forward tcp:5039 tcp:5039
2. adb pull system/bin/app_process project_path/obj/local/armeabi/app_process
3. adb pull system/bin/libc.so /project_path/obj/local/armeabi/libc.so

Now you can connect to gdbserverb (http://mhandroid.wordpress.com/2011/01/23/using-eclipse-for-android-cc-debugging/#more-23 skip steps with ndk-gdb).

PS: dont forget compile your code with following flags

LOCAL_CFLAGS := -g #debug

LOCAL_LDFLAGS := -Wl,-Map,xxx.map #create map fil