Author: admin

Example: Finding access() Calls

Let’s say a library checks for /system/bin/su using the access() function. In Ghidra, you might find a cross-reference to the string "/system/bin/su" which leads to a function calling access().

// Pseudocode snippet from Ghidra/IDA Pro
int __fastcall sub_12345(void *param_1)
{
  ... 
  if (access("/system/bin/su", F_OK) == 0) { // F_OK checks for existence
    return 1; // Root detected
  }
  ...
  return 0; // No root detected
}

Frida Native Hooking Fundamentals

Frida’s Interceptor.attach() is your primary tool for native hooking. It allows you to intercept functions in a target process’s memory space, whether they are exported or not.

// Basic Frida native hook structure
Interceptor.attach(Module.findExportByName("libc.so", "access"), {
  onEnter: function (args) {
    // args[0] is the path argument
    this.path = Memory.readUtf8String(args[0]);
    console.log("access(" + this.path + ") called");
  },
  onLeave: function (retval) {
    console.log("access() returned " + retval.toInt32());
  }
});

Key objects:

• Module.findExportByName(libraryName, functionName): Finds the address of an exported function.
• NativePointer: Represents a memory address.
• Memory.readUtf8String(address): Reads a null-terminated UTF-8 string from memory.
• Memory.writeUtf8String(address, string): Writes a UTF-8 string to memory.
• retval: The original return value of the function. You can modify retval.replace(newValue).
• args: An array of NativePointer objects representing function arguments.

Crafting the Bypass: A Practical Example

Let’s assume our target application checks for /system/bin/su using access(). We want to make access() return -1 (indicating the file does not exist) whenever it tries to check for a known root indicator.

Step 1: Locate the access function

The access() function is typically found in libc.so.

Step 2: Write the Frida Script

// frida_bypass_root.js

Java.perform(function() {
    console.log("[+] Starting Frida root bypass script...");

    var libcModule = Module.findExportByName("libc.so", "access") ? Module.findExportByName("libc.so", "access") : null;
    if (!libcModule) {
        console.error("[-] Could not find 'access' function in libc.so. Trying other common names...");
        // Fallback for different library names or direct addresses if known
        libcModule = Module.findExportByName(null, "access"); // Search all modules
    }

    if (libcModule) {
        console.log("[+] Hooking 'access' at address: " + libcModule);
        Interceptor.attach(libcModule, {
            onEnter: function (args) {
                this.path = Memory.readUtf8String(args[0]);
                this.mode = args[1].toInt32();
                // console.log("access(" + this.path + ", " + this.mode + ") called");

                var rootIndicators = [
                    "/su", 
                    "/magisk", 
                    "/busybox", 
                    "/system/xbin/which",
                    "/sbin/su",
                    "/system/bin/su",
                    "/system/xbin/su",
                    "/data/local/su",
                    "/data/adb/magisk",
                    "/system/app/Superuser.apk",
                    "/system/app/MagiskManager",
                    "/dev/magisk", // Example for device checks
                ];

                for (var i = 0; i < rootIndicators.length; i++) {
                    if (this.path.indexOf(rootIndicators[i]) !== -1) {
                        console.warn("[!] Root indicator found in path: " + this.path + ". Bypassing!");
                        this.doBypass = true;
                        break;
                    }
                }
            },
            onLeave: function (retval) {
                if (this.doBypass) {
                    // Make it look like the file doesn't exist (return -1 and set errno to ENOENT)
                    retval.replace(new NativePointer(-1));
                    // Optionally, set errno to ENOENT (2) if needed for some apps
                    // The 'errno' variable is thread-local, might need to hook __errno or check target architecture
                    // For simplicity, returning -1 is often enough.
                    console.log("[+] access(" + this.path + ") bypassed. Original return: " + retval.toInt32() + ", New return: -1");
                }
            }
        });
    } else {
        console.error("[-] Failed to find 'access' function to hook.");
    }

    // Hooking 'stat' and 'lstat' for similar checks
    var statFunctions = ["stat", "__xstat", "lstat", "__lxstat"];
    statFunctions.forEach(function(funcName) {
        var statAddr = Module.findExportByName("libc.so", funcName);
        if (statAddr) {
            console.log("[+] Hooking '" + funcName + "' at address: " + statAddr);
            Interceptor.attach(statAddr, {
                onEnter: function (args) {
                    // Path argument for stat functions is usually the first or second depending on ABI
                    // For __xstat on 64-bit, path is args[1]
                    // For stat/lstat, path is args[0]
                    if (funcName.startsWith("__xstat")) {
                        this.path = Memory.readUtf8String(args[1]);
                    } else {
                        this.path = Memory.readUtf8String(args[0]);
                    }
                    
                    var rootIndicators = [
                        "/su", 
                        "/magisk", 
                        "/busybox", 
                        "/system/xbin/which",
                        "/sbin/su",
                        "/system/bin/su",
                        "/system/xbin/su",
                        "/data/local/su",
                        "/data/adb/magisk",
                        "/system/app/Superuser.apk",
                        "/system/app/MagiskManager",
                        "/dev/magisk",
                    ];

                    for (var i = 0; i < rootIndicators.length; i++) {
                        if (this.path.indexOf(rootIndicators[i]) !== -1) {
                            console.warn("[!] Root indicator found in path for " + funcName + ": " + this.path + ". Bypassing!");
                            this.doBypass = true;
                            break;
                        }
                    }
                },
                onLeave: function (retval) {
                    if (this.doBypass) {
                        retval.replace(new NativePointer(-1));
                        console.log("[+] " + funcName + "(" + this.path + ") bypassed. New return: -1");
                    }
                }
            });
        } else {
            console.warn("[-] Could not find '" + funcName + "' function to hook.");
        }
    });

    console.log("[+] Frida root bypass script loaded successfully.");
});

Step 3: Execute the Frida Script

Connect your device via ADB and ensure the Frida server is running. Then, execute your script against the target application (replace com.example.app with the actual package name):

frida -U -f com.example.app -l frida_bypass_root.js --no-pause

The --no-pause flag allows the application to start immediately, letting the hooks take effect from its launch.

Advanced Considerations and Bypasses

Bypassing JNI Calls to Native Root Detection

Many apps might call native root detection functions via JNI. You can hook the Java method that triggers the JNI call using Java.use() and prevent it from executing, or modify its return value before the native code is even invoked.

Java.perform(function() {
    var RootChecker = Java.use("com.example.app.security.RootChecker");
    RootChecker.isDeviceRooted.implementation = function() {
        console.log("[+] isDeviceRooted() called, returning false.");
        return false;
    };
});

However, if the JNI method itself then calls a native system function, the prior native hooks will still be effective.

Handling Anti-Frida Measures

Sophisticated applications might try to detect Frida’s presence by:

• Checking for Frida Server processes: Look for frida-server in /proc/self/cmdline or other process listings.
• Scanning for Frida ports: Check for open ports like 27042.
• Memory scanning: Look for Frida agent’s unique memory patterns or injected code.
• Hooking API calls like pthread_create, dlopen, android_dlopen_ext: To detect foreign library injections.

Bypassing these requires additional hooks to hide Frida’s traces or even injecting Frida after the anti-detection checks have passed, often by hooking dlopen to inject your own library at a later stage.

Hooking dlopen for Library Loading Control

If an app loads a specific native library containing root checks at runtime, hooking dlopen (or android_dlopen_ext on Android) can be powerful. You can intercept the library loading, or even inject your own modified library version.

Interceptor.attach(Module.findExportByName("libc.so", "dlopen"), {
  onEnter: function (args) {
    this.libraryName = Memory.readUtf8String(args[0]);
    if (this.libraryName.indexOf("libantiroot.so") !== -1) {
      console.warn("[!] Detected libantiroot.so loading! Possible hook point.");
    }
  },
  onLeave: function (retval) {
    // Can perform actions after library is loaded, e.g., hook functions in the newly loaded module
  }
});

Conclusion

Bypassing native Android root detection with Frida requires a deep understanding of both Android’s internals and reverse engineering techniques. By meticulously identifying native function calls responsible for root checks and strategically intercepting them with Frida’s native hooks, you can effectively deceive even the most robust root detection mechanisms. This expert-level approach empowers security researchers and penetration testers to gain full control over the application’s execution flow, enabling further analysis and vulnerability discovery.