Introduction to Android Root Detection and Bypass

The ability to root an Android device grants users unparalleled control over their operating system, enabling custom ROMs, advanced debugging, and powerful system modifications. However, this power comes at a cost, as many applications, particularly those handling sensitive data like banking, payment, or DRM-protected content, implement robust root detection mechanisms. These mechanisms are designed to prevent potential security risks associated with rooted environments, often blocking app functionality or refusing to launch altogether.

This expert-level lab delves into the intricacies of Android’s primary root detection APIs: SafetyNet Attestation and its successor, the Play Integrity API. We will explore how these APIs function, analyze common client-side root detection techniques, and demonstrate practical methods to bypass them, focusing on the techniques employed in software reverse engineering and decompilation.

Understanding SafetyNet Attestation

SafetyNet Attestation was Google’s initial framework for assessing the integrity and compatibility of an Android device. It operated by providing developers with an cryptographic attestation report containing verdicts on two crucial aspects:

• Basic Integrity: Confirms if the device is running Android and hasn’t been tampered with in low-level ways, such as a custom ROM or an unlocked bootloader.
• CTS Profile Match: Verifies if the device passes the Android Compatibility Test Suite (CTS) and has been approved by Google. Devices that fail this typically have a modified system image, are running an unofficial Android build, or have an unlocked bootloader.

The attestation process involved the client-side app requesting a nonce, sending it to Google’s servers along with device information, and receiving a signed JWS (JSON Web Signature) response. The app’s backend server would then verify this JWS to determine the device’s integrity.

Client-Side SafetyNet Implementation Example (Java/Kotlin)

While deprecated, understanding SafetyNet’s client-side invocation is crucial for legacy bypass scenarios:

// Deprecated in favor of Play Integrity API
SafetyNetClient client = SafetyNet.getClient(this);
client.attest(nonce, API_KEY)
    .addOnSuccessListener(this, new OnSuccessListener<SafetyNetApi.AttestationResponse>() {
        @Override
        public void onSuccess(SafetyNetApi.AttestationResponse response) {
            String jwsResult = response.getJwsResult();
            // Send jwsResult to your backend for verification
        }
    })
    .addOnFailureListener(this, new OnFailureListener() {
        @Override
        public void onFailure(@NonNull Exception e) {
            // Handle error
        }
    });

Transition to Play Integrity API

The Play Integrity API is the modern, more robust successor to SafetyNet. It provides a unified set of signals to help apps and games determine if interactions are genuine and from a trustworthy device. It offers a more comprehensive attestation, including:

• Device Integrity: Similar to SafetyNet’s basic integrity and CTS profile match. It checks if the device is genuine Android, unrooted, and free from known malware.
• Account Details: Verifies if the Google Play account is licensed and legitimate.
• App Integrity: Checks if the app is the genuine version distributed by Google Play and hasn’t been tampered with.
• Environment Integrity: Assesses other signals like device reputation and other Play Protect signals.

The Play Integrity API is designed to be more resilient to client-side tampering, leveraging hardware-backed security features and a continuously updated threat model.

Invoking Play Integrity API (Kotlin)

val integrityManager = PlayIntegrityManager.create(applicationContext)
val request = IntegrityTokenRequest.builder()
    .setNonce(generateNonce())
    .build()

integrityManager.requestIntegrityToken(request)
    .addOnSuccessListener { response ->
        val integrityToken = response.token()
        // Send integrityToken to your backend for verification
    }
    .addOnFailureListener { e ->
        // Handle error
    }

Common Client-Side Root Detection Techniques

Before an app calls SafetyNet or Play Integrity, it often performs a series of client-side checks. These are easier to bypass but frequently updated:

1. File Existence Checks

   Apps look for common root-related files or directories.

   public boolean isRooted() {
       String[] paths = { "/system/app/Superuser.apk", "/sbin/su", "/system/bin/su",
                          "/system/xbin/su", "/data/local/xbin/su", "/data/local/bin/su",
                          "/system/sd/xbin/su", "/system/bin/failsafe/su", "/data/local/su" };
       for (String path : paths) {
           if (new File(path).exists()) {
               return true;
           }
       }
       return false;
   }

2. Package Name Checks

   Searching for popular root management apps.

   public boolean hasRootPackages() {
       PackageManager pm = getPackageManager();
       try {
           pm.getPackageInfo("eu.chainfire.supersu", PackageManager.GET_ACTIVITIES);
           return true;
       } catch (PackageManager.NameNotFoundException e) {
           // Package not found, likely not rooted
       }
       try {
           pm.getPackageInfo("com.topjohnwu.magisk", PackageManager.GET_ACTIVITIES);
           return true;
       } catch (PackageManager.NameNotFoundException e) {
           // Package not found
       }
       return false;
   }

3. Test-Keys in Build Tags

   Checking if the build fingerprint contains `test-keys`.

   public boolean checkTestKeys() {
       String buildTags = android.os.Build.TAGS;
       return buildTags != null && buildTags.contains("test-keys");
   }

4. Executing `su` Command

   Attempting to execute the `su` binary and checking for its output or success.

   public boolean canExecuteSu() {
       try {
           Process process = Runtime.getRuntime().exec("su");
           DataOutputStream os = new DataOutputStream(process.getOutputStream());
           os.writeBytes("idn");
           os.flush();
           DataInputStream is = new DataInputStream(process.getInputStream());
           String line = is.readLine();
           if (line != null && line.contains("uid=0")) {
               return true; // Root access confirmed
           }
           process.destroy();
       } catch (Exception e) {
           // Not rooted or su not found
       }
       return false;
   }

Bypassing Root Detection: A Practical Approach

1. Tools of the Trade

• ADB (Android Debug Bridge): For shell access and pushing/pulling files.
• Frida: A dynamic instrumentation toolkit for hooking functions in real-time.
• JADX/Ghidra/Bytecode Viewer: For decompiling APKs to analyze Java/Smali code.
• Magisk (for legitimate rooting): For systemless root and hiding capabilities (MagiskHide, now deprecated for Zygisk/DenyList).
• LSPosed/Xposed: Frameworks for injecting and modifying app behavior.

2. Static Analysis and Code Review

First, decompile the target APK using JADX. Search for keywords like `su`, `root`, `magisk`, `safetynet`, `integrity`, `PackageManager`, `Runtime.getRuntime().exec`. Identify methods that perform these checks.

# Example JADX usage
jadx -d output_dir com.example.app.apk

3. Dynamic Analysis and Frida Hooks

Frida is invaluable for runtime manipulation. Let’s demonstrate bypassing a simple `isRooted()` check by hooking the `File.exists()` method or directly manipulating the return value of the app’s root check function.

Frida Script Example: Bypassing `File.exists()`

This script hooks `java.io.File.exists()` and makes it return `false` for specific root-related paths. This is a common method for bypassing simple file existence checks.

Java.perform(function () {
    var File = Java.use("java.io.File");

    File.exists.implementation = function () {
        var filePath = this.getAbsolutePath();
        console.log("Checking file existence: " + filePath);

        // Bypass common root indicators
        if (filePath.includes("/sbin/su") || 
            filePath.includes("/system/bin/su") || 
            filePath.includes("/system/xbin/su") ||
            filePath.includes("/data/local/su") ||
            filePath.includes("/data/adb/magisk") ||
            filePath.includes("/system/app/Superuser.apk") ||
            filePath.includes("/vendor/bin/su")) {
            console.log("File existence check bypassed for: " + filePath);
            return false;
        }
        return this.exists(); // Call original method for other paths
    };

    // Hooking PackageManager.getPackageInfo for known root packages
    var PackageManager = Java.use("android.app.ApplicationPackageManager");
    PackageManager.getPackageInfo.overload('java.lang.String', 'int').implementation = function(packageName, flags) {
        if (packageName === "com.topjohnwu.magisk" || packageName === "eu.chainfire.supersu") {
            console.log("Package check bypassed for: " + packageName);
            throw PackageManager.NameNotFoundException.$new(packageName); // Simulate not found
        }
        return this.getPackageInfo(packageName, flags);
    };

    // Hooking Runtime.exec for 'su' command
    var Runtime = Java.use("java.lang.Runtime");
    Runtime.exec.overload('java.lang.String').implementation = function(command) {
        if (command === "su") {
            console.log("Runtime.exec('su') call bypassed!");
            // Return a dummy process that indicates no root, or throw exception
            // For simplicity, we'll return a process that indicates failure
            var dummyProcess = Java.use("java.lang.Process").$new(); // This might require more complex dummy process mocking
            return dummyProcess;
        }
        return this.exec(command);
    };

    // Hooking the specific root check method in your app (if identified)
    // Example: If an app has 'com.example.app.security.RootChecker.isDeviceRooted()' method
    // var RootChecker = Java.use("com.example.app.security.RootChecker");
    // RootChecker.isDeviceRooted.implementation = function() {
    //     console.log("App's custom root check bypassed!");
    //     return false;
    // };
});
```

frida -U -f com.your.package.name -l frida_root_bypass.js --no-pause

Java.perform(function () {
    var PlayIntegrityManager = Java.use("com.google.android.play.core.integrity.PlayIntegrityManager");
    var IntegrityTokenRequest = Java.use("com.google.android.play.core.integrity.IntegrityTokenRequest");
    var IntegrityTokenResponse = Java.use("com.google.android.play.core.integrity.IntegrityTokenResponse");
    var Task = Java.use("com.google.android.gms.tasks.Task");
    var Tasks = Java.use("com.google.android.gms.tasks.Tasks");

    PlayIntegrityManager.requestIntegrityToken.overload('com.google.android.play.core.integrity.IntegrityTokenRequest').implementation = function (request) {
        console.log("Intercepted Play Integrity API request!");
        
        // Create a dummy success response
        var dummyTokenResponse = IntegrityTokenResponse.$new();
        // You would need to set an actual valid (but fake) token here,
        // which is extremely difficult as tokens are signed by Google.
        // For demonstration, we simulate success without a valid token.
        // In a real scenario, you'd try to cache a legitimate token or use a known bypass module.
        // For now, let's just return a successful task.
        
        // This part is highly complex and depends on mocking the entire Task and Response objects.
        // A simpler approach for *some* apps might be to just return a resolved task.
        // For robust bypass, this typically requires patching the app or using system-level hooks.

        // Returning a pre-resolved task is one way to mock a successful call.
        // This would require creating a mock IntegrityTokenResponse object.
        // As direct object creation of complex internal classes can be tricky, 
        // often a module like Magisk's Universal SafetyNet Fix is used to trick the API itself.

        // For a basic demo, we might return a 'succeeded' task with a dummy value.
        // Note: This will LIKELY NOT work for real apps with backend verification 
        // as the token won't be valid.
        
        var CompletableFuture = Java.use('java.util.concurrent.CompletableFuture');
        var future = CompletableFuture.$new();
        future.complete('DUMMY_INTEGRITY_TOKEN'); // Replace with a sophisticated mock if possible
        
        return Tasks.forResult(future.get()); // Mock a successful task result
    };
});