Y Dmitry Yarygin Tech
← Back to home

May 25, 2026

Android Root Detection Bypass — Reverse Engineering Part 1

A practical lab guide explaining Android root detection, dynamic bypass with Frida, and static APK analysis with JADX and smali.

In this guide we are going to look at Android root detection and two common ways to bypass it in a lab environment.

The point is not to “hack random apps”. The point is to understand how Android applications try to protect themselves, how these checks are implemented, and why relying only on client-side checks is usually not enough.

We will use a deliberately vulnerable demo app made for learning and testing.

What Is a Root Check?

A root check is a security check used by Android apps to detect whether the device has been modified.

For example, an app may try to detect:

If the app detects root, it may block the user, close itself, or disable sensitive features.

This is common in apps like:

The logic is simple: if the device is heavily modified, the app cannot fully trust the environment.

Why Apps Care About Root

A rooted device gives the user, and potentially malware, much more control over the system.

That can make it easier to:

That is why many apps try to detect root before allowing access to sensitive screens.

But there is an important limitation: root detection happens on the client side. If the check is only inside the APK, a reverse engineer can often find it and modify it.

Two Main Bypass Approaches

There are two common ways to bypass root checks during Android security testing.

1. Dynamic Bypass

Dynamic bypass means we change app behavior while the app is running.

The APK itself is not permanently modified. Instead, we use instrumentation tools like Frida to hook methods at runtime and change what they return.

For example, if the app asks:

Is this device rooted?

We intercept that call and force the answer to be:

No. Absolutely not

Even if the device is actually rooted.

Tools Used

For dynamic bypass, we usually need:

2. Static Bypass

Static bypass means we modify the APK itself.

The process usually looks like this:

  1. Decompile the APK.
  2. Find the root detection logic.
  3. Modify the smali code.
  4. Rebuild the APK.
  5. Sign the APK.
  6. Install and test it.

This is more permanent than a Frida hook, because we are changing the application package directly.

Lab Setup

For this kind of testing, use a safe lab environment:

Do not test this on apps you do not own or do not have permission to analyze.

Checking That the Emulator Is Rooted

First, confirm that the test emulator has root access.

adb root
adb shell
whoami

If the device is rooted, the output should be:

root

That confirms we are testing on a rooted environment.

Now launch the app. In the demo app, the root check blocks the application and shows a message like:

Root access detected. Closing application.

That is the behavior we want to analyze.

Dynamic Bypass with Frida

Frida lets us modify app behavior during runtime.

First, install the Frida client on your computer:

pip install frida-tools

Check that Frida is available:

frida --version
frida-ls-devices

You should see your emulator in the device list.

Installing Frida Server on Android

Download the correct Frida server binary for your emulator architecture.

For many Android Studio emulators, this may be x86 or x86_64.

Push it to the emulator:

adb push frida-server /data/local/tmp/
adb shell chmod +x /data/local/tmp/frida-server

Start it:

adb shell
su
/data/local/tmp/frida-server &

Then check from your computer:

frida-ls-devices

If everything is working, the emulator should appear.

Installing the Demo APK

Install the app:

adb install app-debug.apk

Launch it and confirm the root detection behavior.

The expected result on a rooted device is that the app detects root and blocks access.

Running a Frida Root Bypass Script

In a real lab, you can use a Frida script that hooks common root detection calls.

The idea is usually to intercept checks such as:

A typical Frida command looks like this:

frida -U -f com.example.vulnerableapp -l root-bypass.js

Where:

-U

means USB/emulator device,

-f

means spawn the app by package name,

and:

-l root-bypass.js

loads the Frida script.

After the script is loaded, the app should behave as if the device is not rooted.

That is dynamic bypass: we did not modify the APK. We only changed behavior while the app was running.

Static Analysis with JADX

Now let’s look at the static approach.

Open the APK in JADX GUI:

jadx-gui app-debug.apk

Look through the package structure and find the main app logic.

In the demo app, the interesting area is the activity that runs after login. This is where the app checks whether the device is rooted.

Search for names like:

root
isRooted
isDeviceRooted
checkRoot
su
magisk

A vulnerable demo app may have a method that looks similar to this:

private boolean isDeviceRooted() {
    String[] paths = {
        "/system/bin/su",
        "/system/xbin/su",
        "/sbin/su",
        "/system/app/Superuser.apk"
    };

    for (String path : paths) {
        if (new File(path).exists()) {
            return true;
        }
    }

    return false;
}

This is easy to understand: if one of the known root paths exists, the app returns true.

If the method returns true, the app blocks access.

Finding the Smali Code

JADX helps us understand the code, but to patch the APK we usually work with smali.

Decompile the APK with apktool:

apktool d app-debug.apk -o app_src

Now search inside the decompiled folder:

grep -Rni "isDeviceRooted" app_src/
grep -Rni "root" app_src/
grep -Rni "su" app_src/
grep -Rni "magisk" app_src/

Do not blindly search for random library names unless you know the app uses them. Start with the actual logic from the app.

Once you find the correct smali file, open it in your editor.

Understanding the Boolean Return

In smali, a boolean method has Z as its return type.

Example:

.method private isDeviceRooted()Z

Z means boolean.

This returns true:

const/4 v0, 0x1
return v0

This returns false:

const/4 v0, 0x0
return v0

So if the root check method returns true when root is found, we can patch it to always return false in our lab app.

Patching the Root Check

Original logic may look complicated, but the simplest lab patch is this:

.method private isDeviceRooted()Z
    .locals 1

    const/4 v0, 0x0
    return v0
.end method

Now the method always says:

Device is not rooted.

Even if the emulator is rooted.

This demonstrates the weakness of relying only on local client-side root checks.

Rebuilding the APK

After editing the smali file, rebuild the app:

apktool b app_src -o app-patched-unsigned.apk

If you get build errors, check the smali syntax carefully.

Common mistakes:

Aligning and Signing the APK

Align the APK:

zipalign -p -f 4 app-patched-unsigned.apk app-patched-aligned.apk

Create a debug key if needed:

keytool -genkeypair \
  -v \
  -keystore debug.keystore \
  -alias androiddebugkey \
  -keyalg RSA \
  -keysize 2048 \
  -validity 10000 \
  -storepass android \
  -keypass android

Sign the APK:

apksigner sign \
  --ks debug.keystore \
  --ks-key-alias androiddebugkey \
  --ks-pass pass:android \
  --key-pass pass:android \
  --out app-patched.apk \
  app-patched-aligned.apk

Verify it:

apksigner verify --verbose app-patched.apk

Installing the Patched APK

Remove the original version first:

adb uninstall com.example.vulnerableapp

Install the patched version:

adb install app-patched.apk

Launch the app again.

If the patch worked, the app should no longer block access because of root detection.

Dynamic vs Static Bypass

Both approaches are useful, but they solve different problems.

Dynamic Bypass with Frida

Good for:

Bad for:

Static Bypass with Smali

Good for:

Bad for:

What This Teaches Us

This lab shows an important security lesson:

Client-side checks are useful, but they are not enough.

If the app makes an important decision only inside the APK, that decision can often be found, modified, or bypassed.

Better security usually requires multiple layers:

Root detection can be one layer, but it should not be the whole security model.

Final Notes

Root detection bypass is a great beginner topic for Android reverse engineering because it teaches several important skills at once:

Once you understand this workflow, you can move on to more advanced topics like login bypass, SSL pinning bypass, WebView issues, insecure storage, and runtime instrumentation.

Video

This article is based on the video:

Android Root Detection Bypass | Reverse Engineering. Part 1

YouTube: https://youtu.be/PY8TjCS96c8