NO NETWORK · NO TELEMETRY · FAILS CLOSED · v0.3.0

Android

Root framework artifactsRoot

Looks for the traces Magisk, KernelSU, and APatch leave behind — in the app's own mount table and at legacy file paths.

root_magisk_filesCompromising by default

At a glance

Platform
Android
Category
Root
Source
IntegrityChecks.kt · checkRootMagiskFiles / hasRootFrameworkMounts
Default status
Makes status compromised
Seen firing
Seen firing in A01, A07. Based on validated scenarios whose observed result includes this signal; see below.
OWASP MASTG
MASTG-TEST-0045, MASTG-TEST-0050

How it works

What the code inspects.

Reads /proc/self/mountinfo — the app's own mount table, which it can always read — and flags any mount whose source is magisk, KSU, or APatch, or whose path contains /.magisk. Current Magisk mounts a tmpfs named magisk over /debug_ramdisk and over the bin directories it injects su into.

Also tests legacy locations: /sbin/.magisk, /sbin/.core, /data/adb/magisk, /data/adb/ksu, /data/adb/ap, /dev/.magisk.unblock, /cache/.disable_magisk and /init.magisk.rc.

The exploit it addresses

Why this matters.The threat.

Even when su is hidden, the framework still has to mount its files into the system. Those mounts are a second, independent indicator that a systemless root framework is installed.

How it can be bypassed

No single check is sufficient.Known evasions.

The path list alone misses a modern install. /data/adb is owned by root with mode 700, so File.exists() on /data/adb/magisk returns false for an app even when it exists, and the /sbin locations were dropped by Magisk years ago. Confirmed on a Magisk 31 device: path list blind, mount table positive. The library shipped path-only before v0.3.

The mount check is defeated when the framework unmounts its files for the target app: Magisk DenyList (with Zygisk) and KernelSU's umount modules do exactly that, so absence is not proof of a clean device.

Validation scenarios

Where this check is exercised.3 scenarios.

A01
Rooted Android with Magisk

Validated · android

Open →A02
Root hiding (DenyList, Shamiko)

Validated · android

Open →A07
Bootloader setting: compromised, report, off

Validated · android

Open →

References & further reading

All checks
← Root management apps installedTest-keys build →