How to Inspect App Integrity Rules and Installation Verification on Android Using ADB dumpsys app_integrity

In modern mobile threat landscapes, malicious software frequently evades traditional runtime detection through repacking, dynamic code loading, or unauthorized sideloading via third-party application stores. To harden package management against compromised binaries, Android includes the App Integrity Manager (introduced in Android 11 / API 30). The App Integrity Manager intercepts package installation requests before binaries touch physical disk, evaluating each APK against cryptographic rule sets, certificate fingerprints, installer origins, and version constraints. Through the Android Debug Bridge (ADB), security engineers and Android developers can query dumpsys app_integrity to audit active integrity rules and diagnose installation blocks.

Understanding Android App Integrity Architecture

The App Integrity Manager operates as an internal system service (app_integrity) tightly integrated with the Android Package Manager (PackageManagerService):

• Rule Evaluation Pipeline: When an installation session is initiated (via Google Play, enterprise MDM, or ADB), the package manager pauses installation and forwards metadata to the App Integrity Manager.
• Rule Sets: Rules are structured compound expressions pushed to the device by trusted system authorities (such as Google Play Protect). Rules evaluate multiple criteria simultaneously:
  • Package Name: The target application’s declared bundle identifier.
  • App Certificate: SHA-256 fingerprint of the APK’s cryptographic signing key.
  • Installer Package & Certificate: The identity and signing key of the app initiating the installation.
  • Version Code: Blocks downgrade attacks or unverified intermediate versions.
• Action Modes: A rule evaluation resolves to either ALLOW (permit installation) or DENY (abort installation and return an integrity failure code).

Connecting via ADB and Querying app_integrity

To audit app integrity rules, enable Developer Options and USB Debugging on the target Android device. Open a terminal and query the service:

# Verify device connectivity
adb devices

# Dump the full App Integrity service state
adb shell dumpsys app_integrity

The resulting output prints the active rule provider, rule set versions, and recent evaluation telemetry.

Inspecting Active Rule Providers and Version Metadata

Examine the top section of the service dump to verify which security engine manages the device’s integrity rules:

# Filter output to inspect active rule providers and version tags
adb shell dumpsys app_integrity | grep -i -A 10 "Rule provider"

The output details:

• Rule Provider: Typically com.google.android.gms (Google Play Services) or a custom vendor/enterprise security module.
• Version: The timestamp or sequential build version of the active rule database.
• Rules Count: The total number of compiled binary rules currently loaded in memory.

Auditing Integrity Rules and Certificate Fingerprints

To inspect specific rule criteria that block or permit package installations, examine the parsed rules list:

# Inspect loaded integrity evaluation rules
adb shell dumpsys app_integrity | grep -A 20 "Rules:"

Rules are structured as boolean logic formulas. For example, a rule targeting banking app tampering might read:

Rule:
  Formula: (PACKAGE_NAME == "com.example.bank") AND NOT (APP_CERTIFICATE == "3a7b...4f")
  Effect: DENY

If an attacker modifies the banking application and signs it with an untrusted developer certificate, the rule evaluates to DENY, instantly halting installation and reporting INSTALL_FAILED_VERIFICATION_FAILURE.

Simulating and Debugging Package Integrity Failures

When an internal enterprise application fails to install during QA or sideloading, developers often mistake integrity blocks for corrupt APKs. To diagnose whether an installation failure was caused by an App Integrity rule:

1. Attempt the package installation via ADB while capturing logcat output:

# Attempt manual APK installation
adb install -r enterprise_app.apk

# Monitor AppIntegrity and PackageInstaller events in logcat
adb logcat -s AppIntegrityManager:V PackageManager:I

2. If App Integrity blocks the installation, logcat will output:

AppIntegrityManager: Installation of com.company.internal denied by rule: Rule[id=1042]
PackageManager: Verification failed for com.company.internal

Inspecting Installer Whitelists and Enterprise Configurations

In managed enterprise environments (Android Enterprise / Knox), organizations can deploy custom integrity rules to ensure corporate applications are strictly installed from the company’s private EMM repository:

# Inspect installer authority restrictions
adb shell dumpsys app_integrity | grep -i -A 8 "installer"

The output validates whether third-party app stores or web browser package installers are prohibited from deploying software across managed work profiles.

Auditing adb shell dumpsys app_integrity gives security analysts and enterprise mobility administrators absolute clarity into package installation verification, ensuring devices remain impervious to repackaged malware and unauthorized application sideloads.