In order to root Android device, few steps will have to be performed. These steps are done in certain order, which when completed will provide root access.
Major steps involved in rooting are:
- Unlocking Bootloader
- Flashing Custom Recovery
- Install Rooting Script
Unlocking Bootloader
The loader needs to be unlocked so that we can run our code during device boot. By default bootloader uses security feature (usually signing) to verify that the bootloader passes control to verified (company signed) executable/block device. This prevents us from running custom code after bootloader and thus this needs to be “unlocked”. Once bootloader is unlocked, we will be able to run our code directly after the bootloader.
References
- https://source.android.com/docs/core/architecture/bootloader/locking_unlocking
- https://en.wikipedia.org/wiki/Bootloader_unlocking
Flashing Custom Recovery
Once we have unlocked bootloader, we can modify recovery partition and add additional files/executables with extended capabilities. Most commonly used custom recovery toolset is called TWRP (Team Win Recovery Project).
Custom recovery application extends the capabilities of native (maybe vendor-based) recovery tool and in some way standardizes them. We can backup system image, restore it, have terminal access, wipe partitions, etc…
References
Install Rooting Script
Rooting script is an Android patch-set, which is installed to existing Android OS and enables root access.
This is needed because even thought Android devices are quite capable, they are restricted by Android’s security model. If for example we wish to remove some pre-installed apps which are not removable, we cannot do that unless we root the device. The same is true for gaining more elevated permissions.
Other use-cases are installing custom kernel module, changing UI, tweaking locked system settings, etc…
Most common rooting scripst are Magist and MagiskSU. It is installed via custom recovery (e.g. TWRP) and once it’s installed, local root access is enabled.
Magisk is a framework for developers to create modules for modifying and Android system without actually altering system files. This systemless method has the advantage of being less likely to cause issues with system integrity checks like Google’s SafetyNet, which certain apps use to block access from modified devices. Magisk also includes features to hide its presence from specific apps, which is useful for running apps that block access on rooted devices.
MagiskSU is a part of Magisk and is the component that handles managing root access for individual applications. When an app requests root access, MagiskSU is the component that prompts the user to grant or deny that access. It’s comparable to other SU (Switch User) management tools like SuperSU, but unlike SuperSU, MagiskSU is integrated into the systemless framework of Magisk.
References
Rooting Android Emulator
The steps are in my case all needed to root Android emulator
cd ~/Temporary/
git clone https://github.com/shakalaca/MagiskOnEmulator.git
cd MagiskOnEmulator
wget "http://... Magisk-v26.1.apk"
mv Magisk-v26.1.apk magisk.apk
# Create AVD in Android Studio using debug image and then start it
~/Android/Sdk/emulator/emulator -avd Pixel_2_API_30 -writable-system -selinux disabled -qemu -enable-kvm&
adb root
adb shell avbctl disable-verification
adb disable-verity
adb reboot
adb wait-for-device
adb root
adb remount
bash patch.sh canary
adb reboot
adb wait-for-device
adb root
adb remount
curl "https://download.chainfire.eu/1220/SuperSU/SR5-SuperSU-v2.82-SR5-20171001224502.zip?retrieve_file=1" -o supersu.zip
unzip supersu.zip -d supersu
# Download supersu.apk from:
# https://www.apkmirror.com/apk/codingcode/supersu/supersu-2-82-sr5-release/supersu-2-82-sr5-android-apk-download/download/?key=d4b9be630d3f48406d4936fef2789cecd39ce99d
adb install supersu.apk
adb shell "mount -t tmpfs -o size=15M tmpfs /system/xbin"
adb push supersu/x64/. /system/xbin/
Resources
- https://themagisk.com/how-to-install-magisk-on-android-emulator/
- https://github.com/shakalaca/MagiskOnEmulator
- https://root-checker.org/
- https://anthony-f-tannous.medium.com/android-10-emulation-of-magisk-supersu-on-an-aosp-avd-de93ed080fad