bypassing-root-jailbreak-detection

Bypassing Root and Jailbreak Detection

Detection is almost never one check. It is a dozen cheap checks scattered across the app, plus — increasingly — one hardware-backed attestation that no hook can touch. Hooking checks one at a time is whack-a-mole; the work is finding the layer the app actually depends on.

Use only against apps you are authorized to test.

When to Use

• The app exits on launch, shows "rooted device detected", or degrades silently
• The app works on a stock device but not on your test device or emulator
• Frida attaches and the process dies immediately, or frida-ps shows nothing
• objection fails to explore, or hooks stop firing after a few seconds
• You need a stable instrumentation environment before any other testing

When NOT to Use

• TLS interception failures — use bypassing-mobile-pinning; a proxy error is a different problem, though detection can masquerade as one
• The wider assessment — use testing-mobile-applications
• Framework-specific reversing — use the relevant reversing-* skill
• Defeating DRM or licensing to pirate an app — out of scope

Identify the Layer First

Detection lives at four layers, and each needs a different response. Working out which one is firing saves the most time.

Layer	Signals	Response
Java/managed checks	RootBeer, File.exists("/system/xbin/su"), package queries for Magisk	Hook at the Java layer (objection, Frida)
Native checks in .so	stat/access/fopen on su, /proc/self/maps scans	Hook libc, or patch the .so
Instrumentation detection	Dies only when Frida is attached; port 27042 probes; thread-name scans	Hide the agent, not the root
Hardware attestation	Play Integrity, SafetyNet, DeviceCheck, App Attest	Cannot be hooked — see below

# What does the app reference? Decompile and look before hooking.
apktool d target.apk -o out
rg -n 'RootBeer|isRooted|su\b|magisk|superuser|test-keys|/system/xbin|busybox|xposed|frida' -i out/smali* out/res 2>/dev/null | head -30
rg -n 'SafetyNet|PlayIntegrity|IntegrityManager|attest|DeviceCheck' -i out/ | head

# Native side
unzip -j target.apk 'lib/arm64-v8a/*' -d libs
rg -a -o 'su|/system/bin/su|magisk|frida|gum-js-loop|gmain' libs/*.so | sort -u | head -20