Android
Android emulatorEmulator / simulator
Fingerprints the device against emulator build properties and QEMU artifacts. Requires a strong indicator.
At a glance
- Platform
- Android
- Category
- Emulator / simulator
- Source
- IntegrityChecks.kt · checkEmulator
- Default status
- Reported only (set policy / treatEmulatorAsCompromised to block)
- Seen firing
- Seen firing in S02, S03, S04, S05, S06, S07, S08, S09, S10, S11. Based on validated scenarios whose observed result includes this signal; see below.
- OWASP MASTG
- MASTG-TEST-0049
How it works
What the code inspects.
Inspects Build.FINGERPRINT/MODEL/MANUFACTURER/HARDWARE/PRODUCT/BRAND/DEVICE for emulator signatures (generic/unknown/sdk_gphone fingerprints, goldfish/ranchu/vbox86 hardware, Genymotion manufacturer, SDK/emulator products) and checks for QEMU device nodes /dev/qemu_pipe and /dev/socket/qemud.
To avoid false positives it requires at least one strong indicator — a generic fingerprint, emulator hardware, or a QEMU file — before emitting the signal; weak hints alone are ignored.
The exploit it addresses
Why this matters.The threat.
Emulators give an attacker a disposable, fully-controlled, easily-scripted device for mass fraud, bot/automation abuse, and reverse engineering. They are standard infrastructure for farming and for scaling attacks that would be impractical on physical hardware.
How it can be bypassed
No single check is sufficient.Known evasions.
Anti-detection emulator builds and property-spoofing modules rewrite Build.* fields and remove QEMU nodes to mimic a real device.
Not compromising by default — it is reported separately and only flips status when you set treatEmulatorAsCompromised or include 'emulator' in your policy, since many teams legitimately run on emulators in dev/CI.
Validation scenarios
Where this check is exercised.4 scenarios.
References & further reading
- MASTG-TEST-0049: Testing Emulator Detection (Android)Open ↗
https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0049/
- Android Emulator (goldfish/ranchu QEMU)Open ↗
https://developer.android.com/studio/run/emulator
- Genymotion (vbox86 emulator)Open ↗
https://www.genymotion.com/
- RootBeer (reference check set; independent implementation here)Open ↗
https://github.com/scottyab/rootbeer