Introduction: The Cat-and-Mouse Game of Android Root Detection

In the evolving landscape of mobile security, root detection mechanisms are crucial for applications that handle sensitive data, such as banking, gaming, and enterprise apps. These checks aim to prevent their execution on compromised devices, where an attacker might have elevated privileges. However, for security researchers, penetration testers, and reverse engineers, bypassing these checks is a fundamental skill to analyze app behavior, identify vulnerabilities, or simply understand how these protections work. This lab will guide you through the process, from identifying root checks using static analysis to dynamically bypassing them with Frida.

Common Android Root Detection Mechanisms

Android applications employ various strategies to detect if a device is rooted. Understanding these helps in identifying targets for bypass:

• File Existence Checks: Looking for common root-related files and directories like /system/bin/su, /system/xbin/su, /sbin/magisk, /data/local/tmp/su.
• Package Name Checks: Searching for installed packages associated with root management apps (e.g., com.noshufou.android.su, eu.chainfire.supersu).
• Property Checks: Examining system properties for indicators like ro.boot.flash.locked=0 (unlocked bootloader) or ro.debuggable=1.
• Command Execution: Running shell commands like which su or id and parsing their output for root indicators.
• Insecure Path Checks: Verifying if common insecure paths (like /data/local/tmp) are writable, which might indicate a relaxed security posture often found on rooted devices.
• Library Loading & Integrity Checks: Attempting to load native libraries that are modified on rooted devices, or performing integrity checks on core Android components.

Phase 1: Static Analysis – Identifying Root Checks

Static analysis is the first step in understanding an application’s root detection logic without executing it. Tools like Jadx or Ghidra are indispensable here.

Using Jadx for Decompilation

Jadx is an excellent decompiler for Android APKs, converting DEX bytecode back into readable Java code. Let’s assume we have an APK named TargetApp.apk.

1. Decompile the APK:

   jadx -d TargetApp_src TargetApp.apk

2. Keyword Search: Once decompiled, navigate to the generated source code directory (TargetApp_src). Search for common root-related keywords and API calls. A simple grep can be very effective:

   grep -r 'su' TargetApp_src/grep -r 'isRooted' TargetApp_src/grep -r 'Magisk' TargetApp_src/grep -r 'Runtime.getRuntime().exec' TargetApp_src/grep -r 'File.exists' TargetApp_src/

3. Analyze Identified Code: Focus on methods that contain these keywords. For instance, you might find a method like com.example.targetapp.RootChecker.isRooted() that performs a series of checks. Pay attention to methods that return boolean values, as these are often the direct results of root checks. Look for API calls to java.io.File.exists(), java.lang.Runtime.exec(), or property getters like android.os.SystemProperties.get().

Example Snippet from Static Analysis:

// com.example.targetapp.RootChecker.java@Overridepublic boolean isRooted() {    String[] paths = {        "/system/app/Superuser.apk",        "/sbin/su",        "/system/bin/su",        "/system/xbin/su",        "/data/local/xbin/su",        "/data/local/bin/su",        "/system/sd/xbin/su",        "/system/bin/failsafe/su",        "/data/local/su",        "/su/bin/su"    };    for (String path : paths) {        if (new File(path).exists()) {            return true;        }    }    try {        Process process = Runtime.getRuntime().exec(new String[]{"which", "su"});        BufferedReader in = new BufferedReader(new InputStreamReader(process.getInputStream()));        if (in.readLine() != null) {            return true;        }    } catch (Exception e) {        // Log error, but continue    }    return false;}

From this, we identify two primary root detection vectors: file existence checks and which su command execution.

Phase 2: Dynamic Hooking with Frida – Bypassing Root Checks

Frida is a dynamic instrumentation toolkit that allows you to inject scripts into running processes on Android (and other platforms). This enables you to hook functions, inspect memory, and modify behavior in real-time, making it ideal for bypassing root detection.

Frida Setup (Prerequisites)

1. Install Frida on your host machine:

   pip install frida-tools

2. Download Frida server for your device’s architecture: Find the correct architecture (e.g., arm64) using adb shell getprop ro.product.cpu.abi. Download the corresponding frida-server from the Frida releases page.
3. Push Frida server to your device and run it:

   adb push /path/to/frida-server /data/local/tmp/adb shell "chmod 755 /data/local/tmp/frida-server && /data/local/tmp/frida-server &"

Developing a Frida Script for Bypass

Our goal is to modify the identified root checks so they always return a