Setting up Android testing environment if you’re looking for a platform other than Genymotion by creating rooted AVD in Android Studio
For a security enthusiast, a rooted android device is essential to perform dynamic assessments of android applications. They either rely on a physical device, or a virtual device. The disadvantage of going for a physical device is the cost it incurs, the malfunctioning you may cause when rooting the device if a step goes wrong, or worse, leaving your device non-functional / bricked. A bricked device essentially means that the device will not function at all, unless remediating measures are taken, i.e., flashing Android ROM (which in my experience is very tedious process, which may or may not yield desired results).
To avoid issues like these, it is recommended to have a virtual device. Unlike a physical device, you can create a device to your liking and desired test cases, varying RAM and storage, varying operating systems and architectural styles of these android devices.
While Genymotion is the most favored emulator the community prefers, Android Studio does not come with a pre-rooted Android Virtual Device (AVD). Seeing Genymotion rooted AVD made me think if it was possible to root AVD in Android Studio in Ubuntu, and that was the motivation behind creation of this blog.
Disclaimer: For this post, I’m using Ubuntu OS ver. 18.04. You can run the same in a virtual machine, provided your virtual machines supports nested virtualization. To have that enabled, you need to make sure to enable Intel VT-x support in your virtualization application, otherwise you cannot run Genymotion / Android Studio in a VM. It should look something like this in VMWare:
Installation process of Android Studio remains identical across all flavours of Linux, except few minor differences. I’m skipping the explanation of the same, since it is an easy process and there are plenty other blogs that explain it.
Most of the resources that I used and the steps that I’ll be performing for Android AVD rooting have been taken from https://github.com/0xFireball/root_avd/. However, persistence of the rooting procedure may / may not be there in subsequent restarts, and I’ll explain to have a persistent, rooted AVD at your disposal.
Prerequisites:
- Ubuntu 18.04: You can choose any operating system. However, I’m using Ubuntu Linux 18.04.4 LTS, hence I’ll be explaining the process on Ubuntu. The process, however, remains mostly unchanged on other distributions.
- Android Studio: While creating this post, I have Android Studio version 4.0
- Android command line tools: Upon installation of Android Studio, your $HOME directory will contain an Android folder which contains various tools such as Android Debug Bridge (adb), Emulator management tool (emulator), and others. This would be required since we do not want to launch our AVD from Android Studio every time and we would like to install Android Packages, aka APKs, in our AVD.
Below screenshot shows the location of platform-tools and emulator folders in my Ubuntu.
It is also recommended to append these folders to your $PATH variable to make it easier to access adb and emulator
- Applications: For this blog, I’m using the following applications to be installed in my AVD:
a. Superuser — Application that allows privileged (su) access in Android. Download.
b. Drozer agent — Drozer should be installed in host machine, i.e., Ubuntu in my case. Download.
c. frida-server binary — The binary should be selected as per the architecture of AVD and version of Frida installed. At this point I have 12.9.4 installed. Download.
d. Xposed Framework — Framework for modules that can change the behavior of system and applications without touching any APK. Download
e. Inspeckage — A tool developed to offer dynamic analysis of Android applications. By applying hooks to functions of the Android API, Inspeckage will help you understand what an Android application is doing at runtime. Download
f. Any root checker application. Download.
g. The main component — su binary. Depending upon the architecture you are going to use for the AVD, you need to select the correct one from GitHub repository.
AVD creation:
- Launch Android Studio and select “Start a new Android Studio project”
2. For this post, I’m going for “No activity” option, since I do not require any code.
3. Give any name to your project, and click on Finish
4. Once your new project loads, click on “AVD Manager”.
5. A new window pops up. This window is Android Virtual Device Manager console where you can create a new AVD. Click on “Create virtual device”.
6. You’ll be asked to configure your AVD, such as selecting some predefined hardware / form factor of device or create a new hardware / form factor profile. Right now, I’m going for a Pixel 3 profile, however you can choose any profile as per your liking. Once selected, click “Next”.
7. Next, you’ll be asked to choose an image for your AVD. This step is important since you want to select the desired architecture (x86 / x86–64), as well as the desired operating system. In the Github page, the author has mentioned to use a 7.1.1 x86 development image having Google APIs. The reason simply being installation of “Google Play” image (aka stock ROM) does not allow spawning a root shell on the virtual device when we issue “adb root” command. This is because by design, adb root command works in development builds only. Alternatively if you want to run a stock image, you can enable “Developer Options” and perform certain actions, as mentioned in link. For now, I’ll go with x86 image of Android 7.1.1 having Google APIs.
8. Provide a name to the AVD you are creating
9. Since it’s a virtual device you are creating you can modify certain characteristics of the AVD such as RAM, Storage, processor count, and SD card (if you want to assign the same). I’m providing 4 cores, 2GB RAM, 4GB storage and 0.5GB SD Card. Once done, click “Finish”.
10. Your virtual device is ready. You can close Android Studio since its no longer required. From now, you can launch your AVD from command line. To start your AVD, issue the following command:
emulator -avd testAVDHere testAVD is the name of the device I assigned at the point of creation.
AVD Rooting
Now that my AVD is working, we can start the process of rooting it. I’ll turn off my AVD and start it again with the following command
emulator -avd testAVD -writable-system -selinux disabled -qemu -enable-kvmThe -writable-system switch ensures that whatever changes we are making in the /system folder of AVDs, it is persistent through reboots. This can also be seen as a warning message sent by emulator
My suggestion is to create an alias of the command like this:
I’ve kept all my APKs along with frida-server and su binary in Downloads folder. Installing APKs is easy. Simply use the following command:
adb install <apk2>.apkUsing this, we’ll install some APKs
Before proceeding further, I must inform that the image that I chose was an x86 Android image, hence I have downloaded the su binary from the following link:
https://github.com/0xFireball/root_avd/tree/master/SuperSU/x86
Kindly proceed with caution and download the correct su binary as per the architecture you have chosen to create your AVD.
Once you download the correct su binary, the following commands are to be executed on a new terminal window to enable root access and install su binary:
adb root && adb remount
adb push su /system/xbin/su
adb shell chmod 06755 /system/xbin/su
adb shell su --install
adb shell su --daemon&
adb shell setenforce 0Once you complete all these steps, go to your AVD and open the SuperUser application. It will prompt you to update the su binary. This shows that we were successfully able to root our AVD.
Once you click on Continue, it will prompt you to update the binary either via TWRP method or Normal method. Select Normal method.
In my case, I received a prompt that the update was successful.
Click on OK and proceed ahead. In case you get a prompt of update failure, click on continue and then check your root status with the root checker application. It should still show you that root access is working fine.
Root Persistence
It may happen that once the su binary is updated, you would be tempted to reboot your device. But do not perform that action. All changes done for rooting may revert back and the device shall not boot up. Instead, create a snapshot of the working device from the Extended controls option
And that’s it. Whenever you want to have a clean AVD which has all your applications installed, along with working root, simply perform the following actions:
1. Launch the emulator: $HOME/Android/Sdk/emulator/emulator -avd testAVD -writable-system -selinux disabled -qemu -enable-kvm2. Restore the saved snapshot3. Run the following commands:
a. adb root && adb remount
b. adb shell su --daemon&
In the next blog, I’ll show how to configure applications such as Drozer, Frida, Inspeckage, etc.
