BuildConfig.DEBUG vs ApplicationInfo.FLAG_DEBUGGABLE

One area that did highlight the differences in the usages of these flags was following a pen test of our app. The pen test report pointed out to us that attackers can employ a technique called "hooking" where the app is recompiled with the android:debuggable flag changed to true (how this is done I'm not totally sure).

Their recommendation to detect this happening was to add some code as follows:

if (!BuildConfig.DEBUG) {
        try {
            ApplicationInfo appInfo = getPackageManager().getApplicationInfo("uk.co.myapp", 0);
            if ((appInfo.flags & appInfo.FLAG_DEBUGGABLE) != 0) {
                // App has been compromised 
                finish();
                return;
            }
        } catch (Exception ex) {
            ex.printStackTrace();
        }
    }

What you do when you detect this circumstance is down to you. I added it to my startup activity, and if triggered, I display a message followed by the finish() statement.

My experience is that BuildConfig.DEBUG is always linked to the debuggable build attribute in the gradle file.

buildTypes {
    debug {
        debuggable true
    }
    debug {
        debuggable false
    }

    ...
}

The documentation also supports this:

• boolean DEBUG – if the build is debuggable.

getContext().getApplicationInfo().flags & ApplicationInfo.FLAG_DEBUGGABLE was likely the only way to determine if a build was debuggable before the gradle build system and Android Studio replaced eclipse around 2015.

Use BuildConfig.DEBUG because it resolves to a constant which can be used during compilation to optimize code.