Android
Root management apps installedRoot
Queries PackageManager for ~16 known root, su-manager, and hiding apps.
At a glance
- Platform
- Android
- Category
- Root
- Source
- IntegrityChecks.kt · checkRootManagementApps
- Default status
- Makes status compromised
- Seen firing
- Seen firing in A01, A02, A07. Based on validated scenarios whose observed result includes this signal; see below.
- OWASP MASTG
- MASTG-TEST-0045
How it works
What the code inspects.
Calls PackageManager.getPackageInfo for a list of package names: Magisk (and forks), SuperSU, Superuser variants, KingRoot/KingoRoot, KernelSU, APatch, RootCloak, and the Xposed/LSPosed managers.
These package names are declared in the library's AndroidManifest <queries> element so the lookups are visible under Android 11+ package-visibility restrictions.
The exploit it addresses
Why this matters.The threat.
A root-manager app is what grants and brokers root to other apps; its presence means the device is rooted and that root can be handed to malware or to tools that attack your app.
How it can be bypassed
No single check is sufficient.Known evasions.
Magisk can be installed under a randomized package name specifically to defeat package-name checks; its 'Hide Magisk app' feature does exactly this.
KernelSU/APatch managers can be hidden, and an attacker can grant root without any GUI manager installed at all.
Package-visibility rules mean an undeclared package name is simply invisible to the query.
Validation scenarios
Where this check is exercised.3 scenarios.
References & further reading
- MASTG-TEST-0045: Testing Root Detection (Android)Open ↗
https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0045/
- MagiskOpen ↗
Systemless root; DenyList / Zygisk hide root from targeted apps.
https://github.com/topjohnwu/Magisk
- KernelSU — kernel-based rootOpen ↗
https://kernelsu.org/guide/what-is-kernelsu.html
- APatch — kernel-based rootOpen ↗
https://github.com/bmax121/APatch
- Android package visibility (<queries> / getPackageInfo)Open ↗
https://developer.android.com/training/package-visibility
- RootBeer (reference check set; independent implementation here)Open ↗
https://github.com/scottyab/rootbeer