Mobile Runtime

Mobile runtime checks

From v0.1.6, pandaward test --profile local-runtime checks what a test build of your app actually stored on an Android emulator (K-003) or in an iOS simulator (L-002). It sends no network traffic, so it needs no scope manifest. Real devices are refused.

Set up

Name the test builds in .pandaward/config.yaml:

runtime:
  android_package: com.acme.shop    # debuggable build installed on the emulator
  ios_bundle_id: com.acme.shop      # build installed in the booted simulator

Start the emulator or simulator, install the test build, and run the flows that log in or store data. Then:

pandaward test --profile local-runtime

Android (K-003)

1. adb devices must list a serial that starts with emulator- and is in the device state.
2. The emulator must report ro.kernel.qemu=1 (or ro.boot.qemu=1). A real phone does neither, so PandaWard stops there.
3. PandaWard lists shared_prefs with adb shell run-as <package> ls shared_prefs and reads each .xml file the same way. run-as works only for debuggable builds, which is why a release build is refused.

iOS (L-002)

Runs only on macOS with Xcode.

1. xcrun simctl get_app_container booted <bundle id> data must return a path inside CoreSimulator/Devices/.
2. PandaWard converts Library/Preferences/<bundle id>.plist with plutil -convert xml1 and reads the top-level keys.

Results

Outcome	Status
Setting missing, adb or Xcode missing, no emulator or simulator, a real device, a build that is not debuggable	BLOCKED with the reason
A file could not be read	ERROR
A non-empty string under a credential-like key (token, password, secret, session, API key, credential, refresh, auth)	FAIL, one CONFIRMED finding per key
Nothing found	PASS for storage only

Findings and evidence record the file and the key name, never the value. Transport security on Android and Keychain accessibility on iOS are not tested at runtime; the static checks K-001, K-004, L-001 and L-004 cover what can be seen in the source.