RootBeer

A tasty root checker library and sample app. We've scoured the internets for different methods of answering that age old question... Has this device got root?

Root checks

These are the current checks/tricks we are using to give an indication of root.

Java checks

• CheckRootManagementApps
• CheckPotentiallyDangerousAppss
• CheckRootCloakingApps
• CheckTestKeys
• checkForDangerousProps
• checkForBusyBoxBinary
• checkForSuBinary
• checkSuExists
• checkForRWSystem

Native checks

We call through to our native root checker to run some of its own checks. Native checks are typically harder to cloak, so some root cloak apps just block the loading of native libraries that contain certain keywords.

• checkForSuBinary

Disclaimer and limitations!

We love root! both Scott and Mat (the main contributors) use rooted devices. But we appreciate sometimes you might want to have a indication your app is running on a rooted handset. Plus we wanted to see if we could beat the root cloakers. So that's what this library gives you, an indication of root.

Remember root==god, so there's no 100% way to check for root.

Root cloakers

We've tested the Rootbeer lib and it shows an indication of root when testing with the following root cloak apps. However Rootbeer is defeated when using a combination of the root cloakers activated at the same time.

Tested cloakers:

• RootCloak Plus (Cydia) requires Cydia Substrate
• RootCloak - requires Xposed Framework

Usage

RootBeer rootBeer = new RootBeer(context);
if (rootBeer.isRooted()) {
    //we found indication of root
} else {
    //we didn't find indication of root
}

You can also call each of the checks individually as the sample app does.

False positives

Note that sometimes the isRooted() method can return a false positive. This is often because the manufacturer of the device rom has left the busybox binary. This alone doesn't mean that the device is rooted, if you wish to avoid this but still use a convenience method to you can use the following:

rootBeer.isRootedWithoutBusyBoxCheck()

The following devices are known the have the busybox binary present on the stock rom:

• All OnePlus Devices
• Moto E

Dependency

Available on maven central, to include using Gradle just add the following:

dependencies {
    implementation 'com.scottyab:rootbeer-lib:0.0.7'
}

Or use this Jitpack.io link

Building

The native library in this application will now be built via Gradle and the latest Android Studio without having to resort to the command line. However the .so files are also distributed in this repository for those who cannot compile using the NDK for some reason.

Sample app

The sample app is published on Google play to allow you to quickly and easier test the library. Enjoy! And please do feedback to us if your tests produce different results.

Contributing

There must be more root checks to make this more complete. If you have one please do send us a pull request.

Thanks

• Kevin Kowalewski and others from this popular StackOverflow post
• Eric Gruber's - Android Root Detection Techniques article

Other libraries

If you dig this, you might like:

• Tim Strazzere's Anti emulator checks project
• Scott Alexander-Bown's SafetyNet Helper library - coupled with server side validation this is one of the best root detection approaches. See the Google SafetyNet helper docs.

Licence

Apache License, Version 2.0

Copyright (C) 2015, Scott Alexander-Bown, Mat Rollings

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

     http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.