How To Root Android Devices

Biohazard
Jul 20
7 min read

Rooting Android Devices

Here's the complete Android rooting methodology. This is a(n) article / guide on how to root android devices.

Current Landscape (July 2026)

Root Method	How It Works	Stealth	Compatibility	Best For
Magisk v30.7	Systemless (patches boot image)	Medium	Android 6.0–15, universal	General pentesting, module ecosystem
KernelSU	Kernel-level (compiles into kernel)	High	Select GKI kernels	Stealth operations, bypassing detection
APatch	Kernel patching (no source needed)	High	Wide GKI support	Devices where KernelSU won't compile
SuperSU	System-mode (deprecated)	Low	Android 4.x–8.x	Legacy devices only

Magisk remains the gold standard for pentesting due to its module ecosystem, Play Integrity bypasses, and universal compatibility.

Prerequisites

bash

# Install ADB and Fastboot
sudo apt install adb fastboot -y        # Linux
# macOS: brew install android-platform-tools
# Windows: download from developer.android.com

# Verify devices are detected
adb devices
fastboot devices

Prep the target device:

Settings → About Phone → Tap "Build Number" 7 times (enables Developer Options)
Settings → System → Developer Options → Enable:
- OEM Unlocking (critical — grayed out on carrier-locked/US models)
- USB Debugging
Charge to >70% (bootloader mode can't charge on some devices)

The Universal Magisk Method

Step 1: Unlock the Bootloader

⚠️ This wipes the device entirely. Extract any data first.

bash

# Reboot to bootloader
adb reboot bootloader

# Check if unlockable
fastboot flashing unlock       # Pixel, newer Motorola, Nokia
fastboot oem unlock            # OnePlus, Xiaomi, older devices
fastboot oem unlock-go         # Some Xiaomi (no data wipe)

# Follow the on-screen prompt on the device
# Use volume keys to select "Unlock the bootloader"
# Press power to confirm
# DEVICE WILL FACTORY RESET

# After unlock, re-enable USB Debugging (device reset erased it)

Samsung: Samsung devices use Download Mode instead of fastboot, and require an additional step:

bash

# Samsung: boot to Download Mode (Volume Down + Bixby + Power)
# Then unlock in Developer Options first
# Some Samsung US models (Snapdragon) cannot be bootloader-unlocked at all

Manufacturer-specific notes:

Brand	Unlockable?	Method
Google Pixel	Yes (all)	fastboot flashing unlock
OnePlus	Yes (most)	fastboot oem unlock
Xiaomi/Redmi/POCO	Yes (after Mi Unlock wait period)	Mi Unlock Tool, 7-day wait
Samsung (US Snapdragon)	No	Bootloader permanently locked
Samsung (Exynos/International)	Yes	Developer Options toggle
Nokia/HMD	No	No official unlock
Huawei/Honor	No (since 2018)	Bootloader unlock program discontinued
Motorola	Yes (most)	Motorola unlock website, code required
Sony	Yes	Sony unlock website
ASUS	Yes	ASUS unlock APK
Nothing	Yes	fastboot flashing unlock
Carrier-locked (any)	Usually No	Verizon, AT&T, T-Mobile lock bootloaders

Step 2: Get the Stock Boot Image

You need the exact boot image matching the device's current firmware build.

Method A: Extract from factory image

bash

# 1. Download the factory image for your device
# Pixel: https://developers.google.com/android/images
# Other: OEM firmware portal, samfw.com (Samsung), xiaomifirmwareupdater.com

# 2. Extract
unzip oriole-ota-tq3a.230805.001-*.zip
# Look for boot.img or init_boot.img

# If it's a payload.bin (OnePlus, some Xiaomi):
git clone https://github.com/vm03/payload_dumper.git
cd payload_dumper
pip install -r requirements.txt
python payload_dumper.py /path/to/payload.bin
# Extracts boot.img from payload

Method B: Extract from the device itself (rooted temporarily or using recovery)

bash

# If you have TWRP or another custom recovery:
adb reboot recovery
adb shell dd if=/dev/block/by-name/boot of=/tmp/boot.img
adb pull /tmp/boot.img ./

# For A/B devices, check which slot is active:
adb shell getprop ro.boot.slot_suffix
# Then pull the correct partition:
adb shell su -c "dd if=/dev/block/by-name/boot_a of=/sdcard/boot_a.img"
adb pull /sdcard/boot_a.img

Step 3: Patch the Boot Image with Magisk

bash

# 1. Download latest Magisk APK
# Official: https://github.com/topjohnwu/Magisk/releases
# Latest stable: v30.7 (Feb 2026)

# 2. Install on device
adb install Magisk-v30.7.apk

# 3. Push boot image to device
adb push boot.img /sdcard/Download/

# 4. On the device, open Magisk app:
#    Tap "Install" next to Magisk
#    Select "Select and Patch a File"
#    Navigate to /sdcard/Download/boot.img
#    Tap "Let's Go"
#    Magisk will patch and output to /sdcard/Download/magisk_patched_*.img

# 5. Pull patched image to computer
adb pull /sdcard/Download/magisk_patched_*.img ./
mv magisk_patched_*.img magisk_patched.img

Step 4: Flash the Patched Boot Image

bash

# Reboot to bootloader
adb reboot bootloader

# Flash the patched image
fastboot flash boot magisk_patched.img
# Or for devices with init_boot:
fastboot flash init_boot magisk_patched.img

# Reboot
fastboot reboot

# Verify root
adb shell
su
# Grant root when Magisk prompt appears on device
id
# Should show: uid=0(root) gid=0(root)

Step 5: Post-Root Setup

bash

# Regain root after first boot
# Open Magisk → it will prompt to finish setup → tap OK → device reboots

# After reboot, verify:
adb shell su -c "echo 'Root confirmed'"

KernelSU (Stealth Root)

KernelSU operates at the kernel level without modifying system partitions — harder to detect than Magisk.

bash

# Prerequisites: device must use a GKI (Generic Kernel Image) kernel
# Check: Settings → About Phone → Kernel Version
# Must include "android12-5.10" or similar GKI tag

# 1. Download KernelSU Manager APK
# https://github.com/tiann/KernelSU/releases

# 2. Download or compile the KernelSU kernel for your device
# Pre-built GKI kernels: https://github.com/tiann/KernelSU/releases
# Non-GKI: compile with KernelSU integrated

# 3. Flash KernelSU boot image
adb reboot bootloader
fastboot flash boot kernelSU_boot.img
fastboot reboot

# 4. Open KernelSU Manager → root is active
# Grants root per-app, per-namespace — much finer control

KernelSU advantage for pentesting: Apps that detect Magisk often miss KernelSU entirely. No Zygisk, no modules visible in userspace.

APatch (Alternative Root)

APatch is newer, patching the kernel similarly to KernelSU but doesn't require source code.

bash

# 1. Download APatch Manager
# https://github.com/bmax121/APatch/releases

# 2. Extract current boot image (same as Magisk Step 2)

# 3. Use APatch Manager to patch boot image
# Open APatch Manager → Patch → select boot.img
# It generates superkey for authentication

# 4. Flash patched image
fastboot flash boot apatched_boot.img
fastboot reboot

# 5. APatch uses AndroidKeyStoreProvider — strong authentication
# Very hard for apps to detect or tamper with

Root Checker (Quick Verification)

bash

# On-device
adb shell su -c "whoami"
# Expected: root

# Check SafetyNet / Play Integrity (important for apps)
# Magisk: Settings → Enable Zygisk → Configure DenyList
# Then install Play Integrity Fix module

# From computer
adb shell su -c "cat /proc/mounts | grep magisk"
# Expected: references to magisk mounts

Post-Root Hacking Applications

Once rooted, here's what's valuable for your assessment:

Data Extraction

bash

# Pull app data (requires root for protected storage)
adb shell su -c "cp -r /data/data/com.targetcorp.app /sdcard/"
adb pull /sdcard/com.targetcorp.app ./app_data/

# Dump all app databases
adb shell su -c "find /data/data -name '*.db' -o -name '*.sqlite'" | \
  while read db; do
    adb pull "$db" ./databases/
  done

# Extract shared preferences (often contain tokens)
adb shell su -c "find /data/data -name '*.xml' | grep shared_prefs" | \
  while read pref; do
    adb pull "$pref" ./shared_prefs/
  done

Keychain / Keystore

bash

# Android Keystore (hardware-backed keys are NOT extractable, but software ones are)
adb shell su -c "ls -la /data/misc/keystore/"
adb pull /data/misc/keystore/ ./keystore/

# Account manager tokens
adb shell su -c "cat /data/system/users/0/accounts.db"
adb pull /data/system/users/0/accounts.db ./
sqlite3 accounts.db .dump

SSL Pinning Bypass

bash

# Method 1: Frida (works without root on some apps, reliable with root)
pip install frida-tools
frida -U -l ssl_bypass.js -f com.targetcorp.app

# Method 2: Magisk module "TrustMeAlready"
# Install via Magisk → Modules → TrustMeAlready
# Disables SSL certificate checking system-wide

# Method 3: Burp Suite + Magisk module
# Install "MoveCertificates" Magisk module
# Import Burp CA → automatically moved to system trust store

Traffic Capture

bash

# tcpdump on device (Magisk module or direct install)
adb shell su -c "tcpdump -i wlan0 -w /sdcard/capture.pcap" &
# Interact with the app
adb shell su -c "killall tcpdump"
adb pull /sdcard/capture.pcap ./
wireshark capture.pcap

# Or proxy through mitmproxy/Burp
adb shell su -c "settings put global http_proxy 192.168.1.100:8080"
# All app traffic now routed through your proxy

Runtime Manipulation

bash

# Modify app memory/variables at runtime
frida -U -l bypass_root_detection.js -f com.targetcorp.app

# Hook into encryption/decryption functions
frida -U -l hook_crypto.js com.targetcorp.app

# Modify app files to remove restrictions
adb shell su -c "chmod 777 /data/data/com.targetcorp.app/shared_prefs/config.xml"

Extract Wi-Fi Passwords

bash

adb shell su -c "cat /data/misc/wifi/WifiConfigStore.xml" | grep -E 'SSID|PreSharedKey'

Magisk Modules For Hacking

Install through Magisk Manager → Modules:

Module	Purpose
MagiskHide Props Config	Spoof device fingerprint, bypass SafetyNet
Play Integrity Fix	Pass Play Integrity checks
Shamiko	Hide root from apps (better than DenyList)
TrustMeAlready	System-wide SSL pinning bypass
MoveCertificates	Move user CA certs to system store
Busybox for Android NDK	Full Linux toolset on device
LSPosed	Xposed framework for runtime hooks
Frida Gadget Injector	Inject Frida into target apps

Detection & Evasion For Your Report

Test the organization's apps against these evasion techniques:

bash

# Test 1: Baseline — app detects root?
# → Document: "App refused to run, root detected"

# Test 2: Magisk DenyList
# Magisk → Settings → Configure DenyList → add target app
# → Document: "App detected root despite DenyList"

# Test 3: Shamiko module
# Install Shamiko → reboot → test app
# → Document: "Shamiko bypassed detection, app ran normally"

# Test 4: KernelSU
# Switch to KernelSU root → test app
# → Document: "KernelSU completely evaded all detection"

# Test 5: Magisk Delta (Magisk fork with better hiding)
# Document per-app detection results

Report Template

markdown

## Finding M-008: Android Device Rootability Assessment

Severity: High

### Fleet Analysis
| Device | Android | OEM Unlockable? | Root Achieved? | Method |
|--------|---------|-----------------|----------------|--------|
| Pixel 7 | 15 | Yes | Yes | Magisk v30.7 |
| Pixel 8 Pro | 15 | Yes | Yes | KernelSU |
| Galaxy S23 (US) | 14 | No (carrier) | No | N/A |
| OnePlus 12 | 15 | Yes | Yes | Magisk v30.7 |
| Moto G Stylus | 13 | Yes (code) | Yes | Magisk v30.7 |

### Root Detection Testing
| App | Magisk (DenyList) | Magisk (Shamiko) | KernelSU |
|-----|-------------------|-------------------|----------|
| MS Intune Company Portal | Detected ✗ | Detected ✗ | Bypassed ✓ |
| Internal banking app | Detected ✗ | Bypassed ✓ | Bypassed ✓ |
| Okta Verify | Detected ✗ | Detected ✗ | Detected ✗ |
| Salesforce Authenticator | Bypassed ✓ | Bypassed ✓ | Bypassed ✓ |

### Key Compromises Achieved via Root
- Wi-Fi passwords: All saved networks extracted
- App sandbox: 12/12 internal apps fully accessible
- SSL traffic: 8/12 apps intercepted after pinning bypass
- OAuth tokens: 4 apps with plaintext stored tokens

### Remediation
1. **Hardware:** Standardize on devices with bootloader unlock disabled 
   (Samsung Knox-enrolled US models, carrier-locked fleet)
2. **Detection:** Deploy multi-layered root detection (Magisk + KernelSU + APatch)
3. **Play Integrity:** Require STRONG integrity for sensitive apps
4. **Go hardware-backed:** Require StrongBox Keymaster for sensitive operations
5. **Policy:** Implement conditional access blocking rooted devices
6. **Training:** Alert users that rooting wipes device protections