HEY GUYS WHATS UP
its 7 am in the morning the weather is good, why don't we just drink root beer. JK i don't drink beer, sorry!so most of you probably have heard about rooting in android right? it is a method to obtain root access of the device, obtain root access inside the device means we can do basically anything inside it including customizing the ROM etc
so to summarize it rooting is just like privilege escalation but in android
but right now i am not going to talk about rooting but contrary i will talk about detecting rooting devices by this awesome android library called "rootbeer" and we are going to reverse engineer it and compile it again to bypass the checking by editing the "smali"
AWESOME SO LETS GET STARTED
well identifying rooting device is not really that hard once you grasp few tricks of it, it is really simple you just have to check value or configuration that suppose to be inside the unrooted device and compare it with the rooted device once you have that fat checklist you are good to go to create your own method.Some checklist that i got:
- check installed package that are use in rooted device such as:
- superuser.apk
- com.noshufou.android.su
- com.thirdparty.superuser
- eu.chainfire.supersu
- som.ramdroid.appquarantine
- cyanogenmod.superuser (locate in com.android.settings)
- check the directory permission:(is the following directory is writable)
- /data
- /
- /system
- /sys
- /etc
- /dev
- /system/bin
- /system/sbin
- /system/xbin
- /sbin
- /proc
- check default file and configuration
- checking the build tag config
- ~# cat /system/build.prop | grep ro.build.tags (if the build tags is gone it means is rooted)
- ~# ls -l /etc/security/otacerts.zip (if the certs is not there it means the ROM is custom)
link: https://github.com/scottyab/rootbeer
RESPECT! to the developer
to use this put the following line into your gradle build dependency:
dependencies {
compile 'com.scottyab:rootbeer-lib:0.0.7'
}
to use the method of the library is pretty straightforward most of the function is in boolean value so you just have to use the method in if statement and determine what will you do next.
here is the simple code i use for my application:
the following code will show if the device is rooted with certain condition to be check, the function that checking root is check_root()
the usage of the method is pretty clear to use as depicted above. you can get the code in my github:
link: https://github.com/acaciaworld80/mobile-coding-security/blob/master/root_checker.java
so i'm going to install the android app inside my rooted samsung phone for the sake of POC
Note that sometimes the
isRooted() method can return a
false positive. This is often because the manufacturer of the device rom
has left the busybox binary. This alone doesn't mean that the device is
rootednow that we can conclude that some of binary configuration that is identified to be only reside in rooted device can lead to false positive result. because some of them configuration is from the manufacturer and don't consider as root so it is recommended to use other of the checking
ok so we successfully implement the code, so how do you bypass the checking ?
simple tho, you just have to reverse engineer the application -> modified the smali code -> repackaged the apps -> sign the app -> install it again
for the sake of the simplicity lets tamper with one of the detection, i choose the detectkeys method
1. reverse engineer the application = use apktool to decode the application to smali bytecode or you can use backsmali both of them is okay but i prefer to use apktool.
after i done reverse engineer the application i go to the com directory and represented with bunch of smali file. but lets just focus on MainActivity.smali file
you can open the file with any text file editor, in here i use nano text editor
reading smali instruction is not really difficult it just require little practice in smali all of the equivalent android code will be mapped to their smali instruction according to their line position in source code (mark with red rectangle)
in line 37 in my source code(yours might be different) it represent the condition checking if statement for the presence of production keys
if(rootchecker.detectTestKeys()){ //line 37
if the condition is not meet it will jump to the cond0 line 44 which is another if statement for checking potentially dangerous apps that indicate root device in the package directory
if(rootchecker.detectPotentiallyDangerousApps()){ // line 44
to bypass the checking of the root we just have to make the condition of the if statement to jump to another statement achieve this:
i declare one more boolean variable that contain true value (the first red rectangle) and i change the if instruction to, if the production keys is presence which is going to return true and i match it with my new boolean variable and if the value is equal it will jump to another condition. (the second red rectangle)
.line 36
const v1,1
means i create one new line between line 35 and 37, create boolean variable that contain true value
if-eq v2,v1, :cond_0
i change the if statement at the line 37 from if-eqz(means equals zero) to if-eq (means equal). if-eq take two parameter to be compared is the two value is same it will jump to the cond_0
because the value that will return by the function detectTestKeys is true it will jump to another if statement.
check the below link to get more list of smali instruction it helps me a lot to
after editing the smali instruction build the package again with apktool and sign the apk with your own keystore
after that just install the application wala we bypass the first checking, the same concept could be bypass to bypass the rest of the condition.
so that's the end of this blog thank you have a good day :D
Comments
Post a Comment