RootBeer

INTRODUCTION: RootBeer
Simple to use root checking Android library and sample app.

Transcript

1. Root Beer
   Shibuya.apk #21
   @magie_pooh
   

   View Slide

2. View Slide

3. View Slide

4. Root Beer
   • A tasty root checker library and sample app.
   • Java Check
   • Native Check
   

   View Slide

5. Java Check
   • CheckRootManagementApps
   • CheckPotentiallyDangerousAppss
   • CheckRootCloakingApps
   • CheckTestKeys
   • checkForDangerousProps
   • checkForBusyBoxBinary
   • checkForSuBinary
   • checkSuExists
   • checkForRWSystem
   • checkForSuBinary
   

   View Slide

6. detectRootManagementApps
   • Using the PackageManager, check for a list of well known root apps
   • "com.noshufou.android.su"
   • "com.noshufou.android.su.elite"
   • "eu.chainfire.supersu"
   • "com.koushikdutta.superuser"
   • "com.thirdparty.superuser"
   • "com.yellowes.su"
   

   View Slide

7. detectPotentiallyDangerousApps
   • Using the PackageManager, check for a list of well known apps that
   require root
   • "com.koushikdutta.rommanager"
   • "com.koushikdutta.rommanager.license"
   • "com.dimonvideo.luckypatcher"
   • "com.chelpus.lackypatch"
   • "com.ramdroid.appquarantine"
   • "com.ramdroid.appquarantinepro"
   

   View Slide

8. detectRootCloakingApps
   • Using the PackageManager, check for a list of well known root cloak apps (not
   used in isRooted function)
   • “com.devadvance.rootcloak"
   • "com.devadvance.rootcloakplus"
   • "de.robv.android.xposed.installer"
   • "com.saurik.substrate"
   • "com.zachspong.temprootremovejb"
   • "com.amphoras.hidemyroot"
   • "com.amphoras.hidemyrootadfree"
   • "com.formyhm.hiderootPremium"
   • "com.formyhm.hideroot"
   

   View Slide

9. checkForBinary("su")
   • emulator => RootBeer: checkForBinary()
   [179] - /system/xbin/su binary detected!
   

   View Slide

10. checkForBinary("busybox")
    • busybox
    • BusyBox combines tiny versions of many common UNIX
    utilities into a single small executable
    • https://busybox.net/about.html
    • RootԽͨ͠ޙʹೖΕͨΓ͢ΔΒ͍͠
    • ೖͬͨ··ͷ୺຤΋͋ΔΒ͍͠
    • RootBeer#isRootedWithoutBusyBoxCheck
    

    View Slide

11. checkForDangerousProps()
    • Checks for several system properties
    • Runtime.getRuntime().exec("getprop").getInputS
    tream()
    • Լه͕̎ͭ͋Ε͹Rooted൑ఆ
    • ro.debuggable: 1
    • ro.secure: 0
    

    View Slide

12. checkForRWPaths()
    • When you're root you can change the permissions on common system directories, this
    method checks if any of these path Const.pathsThatShouldNotBeWrtiable are writable.
    • "/system"
    • "/system/bin"
    • "/system/sbin"
    • "/system/xbin"
    • "/vendor/bin"
    • "/sbin"
    • "/etc"
    

    View Slide

13. detectTestKeys()
    • Release-Keys and Test-Keys has to do with
    how the kernel is signed when it is compiled.
    Test-Keys means it was signed with a custom
    key generated by a third-party developer.
    • /system/build.prop಺ͷro.build.tags
    

    View Slide

14. checkSuExists()
    • `which su`
    

    View Slide

15. checkForRootNative()
    • Native checks are often harder to cloak/trick
    so here we call through to our native root
    checker
    • JNI??
    

    View Slide

16. Disclaimer
    Remember root==god,
    so there's no 100% way to
    check for root.
    

    View Slide

17. View Slide

18. Thanks!
    

    View Slide