Skip to content

MASTG-DEMO-0133: Root Detection Logic in Native Layer with Insufficient Obfuscation

Download MASTG-DEMO-0133 APK Open MASTG-DEMO-0133 Folder Build MASTG-DEMO-0133 APK

Sample

The sample code demonstrates an Android app that performs a root detection routine implemented in a native library.

The Java/Kotlin layer loads librootcheck.so and calls findRootArtifactPath(), a native function that checks common su binary paths. Regardless of whether this protection mechanism is sufficient to detect root in a real-world scenario, the purpose of this demo is to show that the obfuscation applied to the native layer is not enough to prevent an attacker from reverse engineering the root detection logic with reasonable effort.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
package org.owasp.mastestapp

import android.app.Activity
import android.content.Context
import android.util.Log

// SUMMARY: This sample demonstrates a native root detection routine based on common su binary paths.
class MastgTest(private val context: Context) {

    // FAIL: [MASTG-TEST-0369] Due to weak code obfuscation, the root detection logic remains identifiable in the decompiled library.
    val shouldRunInMainThread = true

    fun mastgTest(): String {
        val results = DemoResults("0x52")

        return try {
            val detectedPath = findRootArtifactPath()

            if (detectedPath != null) {
                val message = "Detected root artifact path '$detectedPath' and triggered the root-detection branch. The test fails because this security-relevant native logic remains identifiable through exported JNI symbols, cleartext su paths, and disassembly despite basic obfuscation."
                Log.w("MASTG-DEMO-0133", message)
                results.add(Status.FAIL, message)
                closeApp()
            } else {
                results.add(Status.PASS, "The root-detection branch was not triggered in this execution.")
            }

            results.toJson()
        } catch (e: Exception) {
            results.add(Status.ERROR, e.toString())
            results.toJson()
        }
    }

    private fun closeApp() {
        val activity = context as? Activity ?: return
        activity.finishAffinity()
    }

    private external fun findRootArtifactPath(): String?

    companion object {
        init {
            System.loadLibrary("rootcheck")
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
#include <jni.h>
#include <cerrno>
#include <string>
#include <unistd.h>

namespace {

constexpr const char *kRootPaths[] = {
    "/system/bin/su",
    "/system/xbin/su",
    "/sbin/su",
};

} // namespace

extern "C"
JNIEXPORT jstring JNICALL
Java_org_owasp_mastestapp_MastgTest_findRootArtifactPath(JNIEnv *env, jobject /* this */) {
    for (const char *path : kRootPaths) {
        const int result = access(path, F_OK);
        if (result == 0 || errno == EACCES) {
            return env->NewStringUTF(path);
        }
    }

    return nullptr;
}

1
2
3
4
5
6
7
8
9
cmake_minimum_required(VERSION 3.22.1)

project(rootcheck)

add_library(rootcheck SHARED native-root-check.cpp)

find_library(log-lib log)

target_link_libraries(rootcheck ${log-lib})

The app is not obfuscated at the Java/Kotlin layer, and the native library is included in the APK as-is without any protection. See Obfuscation for reference on common obfuscation techniques.

Steps

  1. Use unzip to extract the native libraries. In this case, we extracted lib/arm64-v8a/librootcheck.so from the APK.
  2. Use radare2 for Android to disassemble librootcheck.so.
  3. Use Reviewing Disassembled Native Code to inspect the disassembled native code and search for strings referencing typical root indicators, such as su.
1
2
3
4
5
6
7
e scr.color=false
e scr.interactive=false
e bin.relocs.apply=true
e log.quiet=true

?e Strings containing "su":
izz~su

1
2
3
4
#!/usr/bin/env bash
set -euo pipefail

r2 -q -i root_detection.r2 -A librootcheck.so > output.txt

Note: Filtering strings with izz~su is a simplification used here for demonstration purposes. In a real-world scenario, the set of root-related strings and paths to look for is broader. Refer to Root Detection for a comprehensive list of root detection indicators.

Observation

The output contains all the strings containing su paths found in .rodata.

output.txt
1
2
3
4
Strings containing "su":
16  0x000005c8 0x000005c8 14  15   .rodata             ascii   /system/bin/su
17  0x000005d7 0x000005d7 8   9    .rodata             ascii   /sbin/su
18  0x000005e0 0x000005e0 15  16   .rodata             ascii   /system/xbin/su

Evaluation

The test case fails because the native library can be reverse engineered with little effort and the security-relevant root detection logic remains easy to identify.

The output reveals the paths /system/bin/su, /sbin/su, and /system/xbin/su stored as plaintext in .rodata, showing that the root detection indicators are not encoded or encrypted. Finding these strings alone is sufficient to demonstrate the test failure: they tell an attacker exactly what artifacts the library is looking for.

Note: For the purpose of this demo we stop here. In a real assessment you would go further and trace where these strings are used — for example by following cross-references or pivoting through file-access imports like access() — to fully map the detection logic and understand how the result is returned to the Java/Kotlin layer.

Additional Context:

If we use Decompiling Java Code to decompile the app, we'll also see that the Java/Kotlin layer isn't obfuscated, and the code helps correlate the native code with the security-relevant logic. For example, in MastgTest_reversed.java, lines 17, 29 to 37, 48 to 54, and 57 to 58 show that the Java/Kotlin layer loads librootcheck.so, calls the native findRootArtifactPath() function, logs the detected path, and closes the app through finishAffinity() when the native code reports a match.

MastgTest_reversed.java
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
package org.owasp.mastestapp;

import android.app.Activity;
import android.content.Context;
import android.util.Log;
import kotlin.Metadata;
import kotlin.jvm.internal.Intrinsics;

/* JADX INFO: compiled from: MastgTest.kt */
/* JADX INFO: loaded from: classes2.dex */
@Metadata(d1 = {"\u0000(\n\u0002\u0018\u0002\n\u0002\u0010\u0000\n\u0000\n\u0002\u0018\u0002\n\u0002\b\u0003\n\u0002\u0010\u000b\n\u0002\b\u0003\n\u0002\u0010\u000e\n\u0000\n\u0002\u0010\u0002\n\u0002\b\u0003\b\u0007\u0018\u0000 \u000f2\u00020\u0001:\u0001\u000fB\u000f\u0012\u0006\u0010\u0002\u001a\u00020\u0003¢\u0006\u0004\b\u0004\u0010\u0005J\u0006\u0010\n\u001a\u00020\u000bJ\b\u0010\f\u001a\u00020\rH\u0002J\u000b\u0010\u000e\u001a\u0004\u0018\u00010\u000bH\u0082 R\u000e\u0010\u0002\u001a\u00020\u0003X\u0082\u0004¢\u0006\u0002\n\u0000R\u0014\u0010\u0006\u001a\u00020\u0007X\u0086D¢\u0006\b\n\u0000\u001a\u0004\b\b\u0010\t¨\u0006\u0010"}, d2 = {"Lorg/owasp/mastestapp/MastgTest;", "", "context", "Landroid/content/Context;", "<init>", "(Landroid/content/Context;)V", "shouldRunInMainThread", "", "getShouldRunInMainThread", "()Z", "mastgTest", "", "closeApp", "", "findRootArtifactPath", "Companion", "app_release"}, k = 1, mv = {2, 0, 0}, xi = 48)
public final class MastgTest {
    private final Context context;
    private final boolean shouldRunInMainThread;
    public static final int $stable = 8;

    private final native String findRootArtifactPath();

    public MastgTest(Context context) {
        Intrinsics.checkNotNullParameter(context, "context");
        this.context = context;
        this.shouldRunInMainThread = true;
    }

    public final boolean getShouldRunInMainThread() {
        return this.shouldRunInMainThread;
    }

    public final String mastgTest() {
        DemoResults demoResults = new DemoResults("0x52");
        try {
            String strFindRootArtifactPath = findRootArtifactPath();
            if (strFindRootArtifactPath != null) {
                String str = "Detected root artifact path '" + strFindRootArtifactPath + "'. The app closes when a monitored su path is found.";
                Log.w("MASTG-DEMO-0133", str);
                demoResults.add(Status.FAIL, str);
                closeApp();
            } else {
                demoResults.add(Status.PASS, "No monitored su path was found.");
            }
            return demoResults.toJson();
        } catch (Exception e) {
            demoResults.add(Status.ERROR, e.toString());
            return demoResults.toJson();
        }
    }

    private final void closeApp() {
        Context context = this.context;
        Activity activity = context instanceof Activity ? (Activity) context : null;
        if (activity == null) {
            return;
        }
        activity.finishAffinity();
    }

    static {
        System.loadLibrary("rootcheck");
    }
}