Root Detection Bypass Solution

Solution

1. Follow the challenge set up guide.
2. Decode the apk with:
   java -jar apktool d <apk>.
3. Browse to decompiled code and open .smali file. This can be done with your favorite editor.
4. Modify the smali code. E.g. change the file path, delete the root detection check or change the if statement.
   An example can be found below. Many solutions are possible to solve this challenge. Here the if condition is modified:
   (/base/smali/ruhrpott/owasp/com/vuln_app_1/Root_Detection$1.smali)
   

if-eqz v2, :cond_0

to

if-nez v2, :cond_0

5. Rebuild the apk with apktool:
   java -jar apktool b <smali project> <apk name>
   (A subfolder with the name of the apk is create in the current folder.)
6. Sign the rebuild application.
7. Create the keystore (this step is only needed once.):
   keytool -genkey -alias mystore -keyalg RSA -keystore KeyStore.jks -keysize 2048
   (The Ubuntu VM keystore has the password 123456)
8. Sign the application:
   jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore KeyStore.jks <apk> <alias> -storepass <pw>
9. Uninstall old version from emultator /phone:
   adb uninstall <package>
10. Install new version:
    adb install <apk>

Hint

1. It can be useful to decompile the source code with JD-GUI to understand it better. JD-GUI can't be rebuild but provides more readable source code.

Links

• https://source.android.com/devices/tech/dalvik/
• https://source.android.com/devices/tech/dalvik/dalvik-bytecode
• http://pallergabor.uw.hu/androidblog/dalvik_opcodes.html
• https://github.com/JesusFreke/smali/wiki
• https://github.com/JesusFreke/smali/wiki/Registers
• https://github.com/JesusFreke/smali/wiki/TypesMethodsAndFields