How do I run an adb shell command?

Switch on developer options and USB debugging on the phone, plug it in, then run adb shell from a machine with platform-tools installed — or run adb shell on its own to get an interactive prompt and type the command without the prefix. If the command produces binary output, such as a screenshot, use adb exec-out instead of adb shell: the plain shell service attaches a terminal, which rewrites newline bytes and corrupts the data.

Do adb shell commands need root?

Not the ones on this reference. They run as the shell user, which can manage packages for its own Android user, read most dumpsys services, write the settings provider, inject input and read shared storage. Root is only needed for things this reference deliberately avoids — reading another app's private data (except through run-as on a debuggable build), writing system partitions, or reading /data/anr directly.

Why does the output look different on my phone?

Either the Android version or the manufacturer. Some flags and fields arrived in a specific release, and those are noted per command. The rest is OEM patching, which hits dumpsys hardest: a dump is debug output whose text is whatever the service author last printed, and manufacturers change it and backport their changes. Read fields by name rather than by position, and treat an unfamiliar shape as a difference rather than as a failure.

Can I run this from a browser instead of a terminal?

For many commands, yes — the Web ADB tools on this site talk to a phone over WebUSB from a Chromium-based desktop browser, with no SDK installed and nothing uploaded. Each page links to the tool that runs its command, when one exists. Two limits are worth knowing: only one program can hold the ADB interface at a time, so a desktop adb server has to be stopped first, and adb forward and adb reverse cannot work in a browser at all.

dumpsys package

read-only

Everything the package manager knows about one app: version, paths, flags, install source and per-user state.

Command: adb shell dumpsys package
Commands: System services (dumpsys)
Risk: read-only

Syntax

dumpsys package [<package>]

Flags and arguments

Token	Meaning
<package>	Limit the dump to one package. The resolver tables are still printed, and they mention other packages.

Examples

```
dumpsys package com.example
```
One app's version, install time, installer and flags.
```
pm list packages -f -U --show-versioncode
```
Far cheaper when all you need is the inventory.

Reading the output

Sample output

Packages:
  Package [com.example] (a1b2c3d):
    appId=10234
    codePath=/data/app/~~kO7bJ9w==/com.example-Ay8s2Q==
    versionCode=4711 minSdk=24 targetSdk=34
    versionName=1.2.3
    flags=[ SYSTEM HAS_CODE ALLOW_CLEAR_USER_DATA ]
    lastUpdateTime=2024-03-14 12:34:56
    installerPackageName=com.android.vending
    User 0: ceDataInode=1234 installed=true hidden=false stopped=false enabled=0

Indented `key=value` fields inside a `Package [name]` block, then one `User N:` row per Android user. A package can legitimately appear twice: an updated system app has a live block under `Packages:` and its factory copy under `Hidden system packages:`, and reading whichever came last reports the factory version as the installed one. That second block existing at all is the most reliable "this is an updated system app" signal there is.

Output fields

Field	Meaning
versionCode / versionName	The installed version, as an integer and as the display string.
codePath	Where the APK set lives.
flags=[ … ]	Application flags. `SYSTEM` is the one debloating decisions hinge on.
installerPackageName	Who installed it, or the four letters `null` for a preinstalled app.
firstInstallTime / lastUpdateTime	Wall-clock times in the device's own time zone, with no offset printed.
User N: … enabled=	0 default, 1 enabled, 2 disabled, 3 disabled by the user, 4 disabled until used.

What access it needs

The package manager's dump binder calls `DumpUtils.checkDumpAndUsageStatsPermission` with the tag `PackageManager`, so it wants `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`; both are in the Shell package's manifest and the usage-stats check short-circuits `SHELL_UID` before reaching the app-op, so a plain authorised `adb` connection sees everything. No root, no `adb root`, no Settings grant, and no per-package allowance — this dump reads the same records for a system app and for a sideloaded one. The trap is not access, it is argument parsing, and it is worth knowing before you type. `DumpHelper` decides an argument is a package name only when it equals the literal string `android` or **contains a dot**. Everything else is matched against a list of section keywords — `p`, `perm`, `pref`, `prov`, `s`, `f`, `l`, `installs`, `dexopt`, `known-packages`, `protected-broadcasts` and about twenty more. So a dotless argument does not produce a "no such package" message; it either matches a section and dumps something else entirely, or matches nothing and leaves the huge default dump running. Always pass the full package name, and remember it is the only thing keeping the output small: the unfiltered form is one of the largest dumps the device produces. The Android Debloat Tool always names a package for the same reason.

Failure messages, decoded

Message	Meaning
Unable to find package: com.exmaple	The snapshot holds no package state under that name and it is not an APEX either, so the dump returns immediately, printing nothing after this line. It is a stdout line and it is the same answer for three different situations: a typo, an app that was uninstalled, and an app installed only for another Android user. `pm list packages --user 10` separates the last from the first two.
Unknown argument: --full; use -h for help	An option `DumpHelper` does not recognise. It prints this and keeps going rather than stopping, so the rest of the dump still appears and the flag you meant is simply ignored — the danger is reading a default dump as if it had honoured your filter. The options it does accept are `-a`, `-f`, `-h`, `--checkin`, `--all-components`, `--include-apex` and `--proto`.
Permission Denial: can't dump PackageManager from from pid=4821, uid=10231 due to missing android.permission.DUMP permission	From `DumpUtils`, on stdout, in place of the package block. The doubled `from from` is genuine AOSP text. From an ordinary `adb shell` this should never appear; when it does, the caller was not uid 2000, which over a cable almost always means the command ran inside `run-as` and inherited the app's identity.
* SERVICE 'package' DUMP TIMEOUT (10000ms) EXPIRED *	The `dumpsys` default of ten seconds ran out. The unfiltered `dumpsys package` is among the biggest dumps on the device, and naming a package is what normally keeps it inside the deadline. A truncated dump is dangerous here specifically because `Hidden system packages:` comes after the live block — losing the tail loses the evidence that an app is an updated system app.

Version and vendor notes

The timestamps carry no time zone: they were formatted on the phone. Converting them on your own machine silently applies your zone instead, which can be a day out for a phone that travelled.
`firstInstallTime` moved. Android 12 and earlier print it next to `lastUpdateTime`; Android 13 and later print it per user, indented under the `User N:` row.
Absent strings are printed as the four letters `null`, which is never a real package name or path.

We have a UI for this

Android Debloat Tool runs this command over USB and parses what comes back — a Chromium browser, no SDK, nothing uploaded.

Open Android Debloat Tool

Related commands

Commands that turn up in the same session as dumpsys package.

Command	What it does
pm list packages	Lists installed packages, optionally with the APK path, uid, version code and installer.
pm path	Prints the absolute paths of the APK files that make up an installed package.
pm disable-user	Switches a package off for one Android user without removing it — the reversible alternative to uninstalling.
pm uninstall	Removes a package, or removes it for one Android user only — which is how a preinstalled app is disposed of without root.

More System services (dumpsys) commands

Command	What it does
dumpsys battery	The battery service's live state: level, status, health, voltage and temperature.
dumpsys diskstats	Free space per partition, a disk write latency check, and a cached per-app breakdown of what is using storage.
dumpsys thermalservice	Whether the phone is throttling, and every thermal zone the hardware layer reports, in degrees Celsius.
dumpsys sensorservice	Every sensor the phone has, with its vendor, type, rates and batching — plus a buffer of recent readings.
dumpsys meminfo	Which processes are using the most memory, measured as proportional set size.
dumpsys activity activities	Which app is in the foreground, and the task and stack structure behind it.
dumpsys dropbox	The platform's ring buffer of crashes, ANRs and tombstones — how you read ANR traces without root.

Checked against AOSP, toybox and kernel sources while writing the parsers behind our Web ADB tools. Where a behaviour genuinely varies by Android version or manufacturer, this page says so instead of giving a number that would be wrong on half the phones out there.