Root Detection Bypass

Part 5 of the Android Pentest series.

Many apps probe for root indicators at startup and refuse to run (or silently disable functionality) if they find any. To test such an app you have to make those probes lie. The frida_ssl.js script handles the common detection families.

Detection vectors and how they’re defeated

Vector	What the app does	The bypass
Package-based	Queries PackageManager for known root apps	Spoof getPackageInfo for Magisk, SuperSU, KingoRoot, etc.
Binary-based	Checks java.io.File for su, busybox, magisk	Hook File.exists() to return false for those paths
Property-based	Reads ro.build.selinux, ro.debuggable, ro.secure	Override SystemProperties.get() with safe values
Command execution	Runs which su, id, getprop via Runtime.exec	Rewrite root-probe commands to harmless ones
Native layer	Same checks from C via libc	Hook fopen/system in libc.so

The key insight: Java-layer hooks won’t catch native checks and vice versa. A robust bypass covers both layers, which is why the script hooks libc.so in addition to the Java APIs.

Running it

# Spawn the target app with root bypass active
frida -U -f <package.name> -l script/frida_ssl.js

📌 Use -f (spawn), not -F (attach). Attaching to an already-running process means the root checks have likely already fired during startup. Spawning lets Frida install every hook before the app’s onCreate() runs.

A community alternative if you just need a quick check:

frida -U --codeshare dzonerzy/fridantiroot -f <package.name>

When it doesn’t work

Apps occasionally use an uncommon detection method the script doesn’t cover yet. Watch the Frida console for unhandled checks (the script logs what it intercepts), then extend the relevant hook. The most common gap is the exec-family of native calls (execl, execv, …) used to shell out to su — covered in the Tools & Scripts part, which documents the added execve/execvp coverage.

⚠️ Some apps combine root detection with SSL pinning. Bypassing root alone won’t reveal traffic — you’ll also need SSL pinning bypass.

See also

• Previous: Certificate Injection — Android 14+
• Next: SSL Pinning Bypass
• Tools & Scripts — the full frida_ssl.js hook list

References

• Fridantiroot — Frida CodeShare
• Frida Documentation