Menu
Use the android-kdebug skill when debugging Android apps over ADB. The android-kdebug skill documents using kdebug Frida CLI, the kdebug LLDB CLI, or common adb commands.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Create, write, list, and pull versioned exploit artifact folders through the kartifact CLI.
Wrap an ordinary C exploit or PoC in kernel_PoCs/common so one source project can build as a Linux or Android static executable, dynamic executable, constructor-loaded shared object, or JNI library with local, listening, or reverse-shell root payloads. Use when creating a common-compatible exploit project, converting a C program with main(), setting up exploit entry and post-escalation payload code, repairing its Makefile or entrypoint integration, or initializing the bundled example project.
Add a Linux or Android kernel exploit primitive to ingots_tools/primitives/src/primitive_data in the exact format consumed by primitives/src/primitives/__init__.py. Use when creating a new primitive entry with metadata.json, PRIMITIVE.md, and primitive.c, or when updating an agent to generate primitives for this repository.
Use this skill to launch and manage Android Cuttlefish instances using the cuttle-cli and cuttle-server.
Use the high-level object_db wrapper API to scan kernel objects in Python by loading an ObjectSet and filtering HeapObject entries with helper predicates instead of raw SQL.
Use the `testvm` CLI to pack and unpack initrds, build the default BusyBox initrd, and boot Linux kernels under QEMU on `x86_64`, `arm`, or `aarch64`. Use this when the user asks to run, debug, or explain `testvm` commands.
| name | android-kdebug |
| description | Use the android-kdebug skill when debugging Android apps over ADB. The android-kdebug skill documents using kdebug Frida CLI, the kdebug LLDB CLI, or common adb commands. |
Use this skill when the task is to debug an Android app on an ADB-visible device with kdebug.
kdebug for Frida workflows.kdebug lldb ... for native attach workflows.adb for shell, file transfer, install, and logcat tasks.--device <serial-or-host:port> unless the user gave a different command form.List visible apps:
kdebug --device <target> frida apps
Attach to a running app:
kdebug --device <target> frida attach <package>
Spawn suspended and resume later:
kdebug --device <target> frida spawn <package>
kdebug --device <target> frida resume <session-id>
Inspect active state:
kdebug --device <target> frida sessions
kdebug --device <target> frida scripts
Load a persistent script:
kdebug --device <target> frida load-script <session-id> --name <name> --file hook.js
kdebug --device <target> frida load-script <session-id> --name <name> --source 'rpc.exports = { ping() { return "ok"; } };'
printf '%s\n' 'send("hello")' | kdebug --device <target> frida load-script <session-id> --name stdin-hook --stdin
Run a one-shot script or call RPC exports:
kdebug --device <target> frida eval <session-id> --file probe.js
kdebug --device <target> frida rpc <script-id> <method> [args...]
kdebug --device <target> frida messages <script-id>
Detach and clean up:
kdebug --device <target> frida unload-script <script-id>
kdebug --device <target> frida detach <session-id>
Use --json when the output needs to be consumed by another tool.
Attach by package or PID:
kdebug --device <target> lldb attach-package <package>
kdebug --device <target> lldb attach-pid <pid>
Inspect active LLDB sessions:
kdebug --device <target> lldb sessions
Print the host LLDB command to connect:
kdebug --device <target> lldb connect <session-id>
kdebug --device <target> lldb connect <session-id> --binary <host-binary>
kdebug --device <target> lldb connect <session-id> --binary <host-binary> --sysroot <sysroot>
Stop an LLDB session and remove its port forward:
kdebug --device <target> lldb stop <session-id>
Notes:
kdebug manages lldb-server on the device but does not launch host lldb automatically.kdebug/assets/lldb-server/<abi>/lldb-server.Frida and LLDB commands auto-start one local kdebug daemon for all targets. Explicit daemon commands are only for inspection or cleanup:
kdebug daemon status
kdebug daemon start
kdebug daemon stop
The daemon holds target-scoped Frida sessions, scripts, and LLDB sessions in memory. If it stops, those sessions are gone and must be recreated.
Run shell commands:
adb -s <target> shell <command>
adb -s <target> shell su root sh -c '<command>'
Copy files:
adb -s <target> push <local-path> <remote-path>
adb -s <target> pull <remote-path> <local-path>
Read or write text files:
adb -s <target> shell cat <remote-path>
adb -s <target> shell 'printf %s "content" > <remote-path>'
adb -s <target> shell 'cat > <remote-path>' < local-file
Install apps:
adb -s <target> install <app.apk>
adb -s <target> install-multiple <base.apk> <split.apk>
Inspect logs:
adb -s <target> logcat
adb -s <target> logcat --pid <pid>