Identify device architecture using command – adb shell getprop ro.Enter this command to install Frida – pip install Frida & pip install objection & pip install Frida-tools.In this blog, we will bypass root detection using Frida Framework – If the root detection has been implemented, we need to bypass it, there are several methods to bypass, including reverse engineering, Xpose framework, Frida and objection, etc.

In the following example, you can see how apps implement root detection this is not only the way to implement some apps, not even launch on a rooted device. Detecting this vulnerability is essential to the security of your app, as it is challenging to ensure system security and various protections after gaining root privileges. Hackers often root their devices or use their rooted devices to access sensitive user data and other secrets stored in the app’s source code.

It is essential for security teams and developers to enable apps to detect root detection. If the code is obfuscated, it becomes challenging to read even if it is obfuscated, we can de-obfuscate it by using tools such as JADX, or we can perform Manual De-obfuscationĭevelopers can use the Proguard for obfuscation, ultimately a precaution against reverse engineering. It is a security issue if the code is not obfuscated because anyone can read, manipulate, and reverse it. When the APK has been de-compiled, we are ready to analyze the code, but first, check if the code is obfuscated or not. Here is a simple example of what code looks like after and before obfuscation – The process can change the actual method statement or metadata, but it does not change the program’s output. Missing Security ControlsĬode obfuscation is modifying an executable to make it useless to hackers but still fully functional. In addition to predefined guidelines, code should be tested for technical & logical errors. During static analysis, we look for Permissions, Configurations, Cryptographic issues, Hardcoded sensitive data, and various things that will increase the attack surface for dynamic analysis. Static analysis is a process of testing applications without executing them only the code is examined. If you haven’t read it, check it out now, click here and get back to this. We are considering that you are aware of all the previous concepts. Previously we discussed Android Basics, Reversing APK & LAB Setup for Android Security Testing.

Smali code injection