android-studio-pentest-environment

# Android Studio Pentest Environment Setup > Skill by [ara.so](https://ara.so) — Security Skills collection. This skill provides expertise in setting up a complete Android application penetration testing environment using Android Studio Virtual Device Manager (AVD) with root access via Magisk, Frida dynamic instrumentation, HTTP Toolkit for traffic interception, and LSPosed modules for runtime manipulation. ## What This Project Does This project guides you through building a 2026-ready Android app penetration testing lab that includes: - **Android Studio AVD** with Google APIs (API 36/Android 16) - **Magisk (root)** via rootAVD automation - **Frida** for dynamic instrumentation - **HTTP Toolkit** for HTTPS traffic interception - **LSPosed** with TrustMeAlready and JustTrustMe modules for SSL pinning bypass - **Shamiko** for root hiding - **ZygiskNext** as modern Zygisk replacement ## Prerequisites ### Install Android Studio and SDK ```bash # macOS - Add to ~/.bash_profile or ~/.zshrc export ANDROID_HOME="$HOME/Library/Android/sdk" export PATH="$PATH:$ANDROID_HOME/platform-tools" export PATH="$PATH:$ANDROID_HOME/tools" export PATH="$PATH:$ANDROID_HOME/tools/bin" export PATH="$PATH:$ANDROID_HOME/emulator" # Linux export ANDROID_HOME="$HOME/Android/Sdk" export PATH="$PATH:$ANDROID_HOME/platform-tools" # Windows (PowerShell $PROFILE) $env:ANDROID_HOME = "$env:LOCALAPPDATA\Android\Sdk" $env:Path += ";$env:ANDROID_HOME\platform-tools" ``` Apply the configuration: ```bash source ~/.bash_profile # or ~/.zshrc adb version # Verify installation ``` ### Create Android Virtual Device ```bash # List available system images sdkmanager --list | grep system-images # Download recommended image (Google APIs, not Google Play) sdkmanager "system-images;android-36;google_apis;arm64-v8a" # Create AVD via Android Studio GUI: # Device: Pixel 9 Pro # System Image: API 36 (Android 16), Google APIs, arm64-v8a # RAM: 4096 MB # Internal Storage: 16 GB # VM Heap: 512 MB # Boot option: Cold boot ``` ## Root the Emulator with Magisk ### Method A: rootAVD (Recommended) ```bash # Clone rootAVD (GitLab is now primary, GitHub is read-only) git clone https://gitlab.com/newbit/rootAVD.git cd rootAVD # Download latest Magisk APK and rename to Magisk.zip curl -L -o Magisk.zip https://github.com/topjohnwu/Magisk/releases/download/v28.1/Magisk-v28.1.apk # List available AVDs ./rootAVD.sh ListAllAVDs # Root the specific system image ./rootAVD.sh system-images/android-36.1/google_apis/arm64-v8a/ramdisk.img # Cold boot the emulator (automatic if configured) ``` ### Method B: Manual Magisk Patch (Fallback) ```bash # Start emulator with writable system emulator -avd Pixel_9_Pro_API_36 -writable-system & adb root adb remount # Install Magisk APK adb install Magisk-v28.1.apk # Push ramdisk to device adb push "$ANDROID_HOME/system-images/android-36/google_apis/arm64-v8a/ramdisk.img" /sdcard/Download/ # In Magisk app: Install → Select and Patch a File → choose ramdisk.img # Download patched file back to host adb pull /sdcard/Download/magisk_patched_*.img ./ # Replace ramdisk and restart cp magisk_patched_*.img "$ANDROID_HOME/system-images/android-36/google_apis/arm64-v8a/ramdisk.img" adb reboot ``` ### Configure Magisk ```bash # Open Magisk app and enable: # - Zygisk (Settings → Zygisk) # - Hide Magisk app (Settings → Hide Magisk → Random package name) # Verify root adb shell su -c "id" # Expected: uid=0(root) gid=0(root) ``` ## Install Frida ### Frida Server on Device ```bash # Download Frida server matching your Frida tools version FRIDA_VERSION="16.5.9" curl -L -o frida-server.xz "https://github.com/frida/frida/releases/download/${FRIDA_VERSION}/frida-server-${FRIDA_VERSION}-android-arm64.xz" unxz frida-server.xz # Push to device adb push frida-server /data/local/tmp/ adb shell "chmod 755 /data/local/tmp/frida-server" # Start Frida server adb shell "su -c '/data/local/tmp/frida-server &'" # Verify frida-ps -U ``` ### Frida Tools on Host ```bash # Install Frida CLI pip install frida-tools==16.5.9 # Verify connection frida-ps -U # Should list running processes on emulator ``` ### Frida Usage Examples ```python # attach_script.py - Hook a function import frida import sys def on_message(message, data): print(f"[*] {message}") package = "com.example.app" device = frida.get_usb_device() session = device.attach(package) script_code = """ Java.perform(function() { var MainActivity = Java.use('com.example.app.MainActivity'); MainActivity.checkRoot.implementation = function() { console.log('[*] checkRoot() bypassed'); return false; }; }); """ script = session.create_script(script_code) script.on('message', on_message) script.load() sys.stdin.read() ``` ```bash # Hook SSL pinning check frida -U -f com.example.app -l ssl-pinning-bypass.js --no-pause ``` ## Install LSPosed and Modules ### Install LSPosed (Zygisk version) ```bash # Download LSPosed Zygisk release curl -L -o LSPosed.zip https://github.com/LSPosed/LSPosed/releases/download/v1.9.2/LSPosed-v1.9.2-7024-zygisk-release.zip # Flash via Magisk adb push LSPosed.zip /sdcard/Download/ # In Magisk: Modules → Install from storage → select LSPosed.zip adb reboot ``` ### Upgrade to ZygiskNext ```bash # Download ZygiskNext (modern Zygisk replacement) curl -L -o ZygiskNext.zip https://github.com/Dr-TSNG/ZygiskNext/releases/download/v4.0.2/Zygisk-Next-4.0.2-291-release.zip # Flash via Magisk adb push ZygiskNext.zip /sdcard/Download/ # Magisk: Modules → Install → ZygiskNext.zip # Disable built-in Zygisk in Magisk settings adb reboot ``` ### Install TrustMeAlready (SSL Pinning Bypass) ```bash # Download TrustMeAlready module curl -L -o TrustMeAlready.apk https://github.com/ViRb3/TrustMeAlready/releases/download/v1.11/TrustMeAlready-v1.11.apk # Install APK adb install TrustMeAlready.apk # Activate in LSPosed: # 1. Open LSPosed Manager # 2. Modules → Enable TrustMeAlready # 3. Select target apps or enable globally # 4. Reboot ``` ### Install JustTrustMe (Alternative) ```bash # Download JustTrustMe curl -L -o JustTrustMe.apk https://github.com/Fuzion24/JustTrustMe/releases/download/v.2/JustTrustMe.apk adb install JustTrustMe.apk # Activate in LSPosed similar to TrustMeAlready ``` ## HTTP Traffic Interception ### Method A: HTTP Toolkit ```bash # Install HTTP Toolkit brew install --cask http-toolkit # macOS # Or download from https://httptoolkit.com/ # Start HTTP Toolkit and select "Android Device via ADB" # It will automatically: # 1. Install HTTP Toolkit app on emulator # 2. Configure system proxy # 3. Install CA certificate # Verify proxy is set adb shell settings get global http_proxy ``` ### Method B: Manual Proxy Setup ```bash # Set up proxy (e.g., Burp Suite on 127.0.0.1:8080) adb shell settings put global http_proxy 127.0.0.1:8080 # Install CA certificate # 1. Export cert from Burp (DER format) # 2. Convert to PEM and get hash openssl x509 -inform DER -in burp.cer -out burp.pem HASH=$(openssl x509 -inform PEM -subject_hash_old -in burp.pem | head -1) # Push to system store adb root adb remount adb push burp.pem "/system/etc/security/cacerts/${HASH}.0" adb shell chmod 644 "/system/etc/security/cacerts/${HASH}.0" adb reboot ``` ## Install Shamiko (Root Hiding) ```bash # Download Shamiko curl -L -o Shamiko.zip https://github.com/LSPosed/LSPosed.github.io/releases/download/shamiko-281/Shamiko-v0.7.4-281-release.zip # Flash via Magisk adb push Shamiko.zip /sdcard/Download/ # Magisk: Modules → Install → Shamiko.zip adb reboot # Configure Shamiko whitelist mode # Magisk: Shamiko → Whitelist mode → Add apps to hide root from ``` ## Testing and Verification ### Verify Root Status ```bash # Check root access adb shell su -c "whoami" # Expected: root # Test with Magisk app adb shell pm list packages | grep -i magisk # Should show random package name if hidden ``` ### Verify Frida ```bash # List processes frida-ps -U # Test hook frida -U -f com.android.settings -l test.js # test.js content: # Java.perform(() => { # console.log('[*] Frida is working!'); # }); ``` ### Verify SSL Pinning Bypass ```bash # Start HTTP Toolkit or Burp # Launch target app # Attempt HTTPS request # Traffic should appear in proxy without certificate errors ``` ## Common Patterns ### Install APK and Analyze ```bash # Install APK adb install target.apk # List app info adb shell pm list packages -f | grep target adb shell dumpsys package com.example.target | grep version # Pull APK for static analysis adb shell pm path com.example.target adb pull /data/app/com.example.target-xxx/base.apk ``` ### Hook Function with Frida ```javascript // hook_login.js Java.perform(() => { const LoginActivity = Java.use('com.example.app.LoginActivity'); LoginActivity.validateCredentials.implementation = function(username, password) { console.log(`[*] Username: ${username}`); console.log(`[*] Password: ${password}`); return this.validateCredentials(username, password); }; }); ``` ```bash frida -U -f com.example.app -l hook_login.js --no-pause ``` ### Bypass Root Detection ```javascript // bypass_root.js Java.perform(() => { // Hook common root detection methods const RootBeer = Java.use('com.scottyab.rootbeer.RootBeer'); RootBeer.isRooted.implementation = () => false; const File = Java.use('java.io.File'); File.exists.implementation = function() { const path = this.getAbsolutePath(); if (path.includes('su') || path.includes('magisk')) { return false; } return this.exists(); }; }); ``` ### Extract Secrets from Memory ```python # dump_strings.py import frida import sys package = "com.example.app" device = frida.get_usb_device() pid = device.spawn([package]) session = device.attach(pid) script = session.create_script(""" Java.perform(() => { const String = Java.use('java.lang.String'); String.$init.overload('java.lang.String').implementation = function(str) { if (str.includes('api_key') || str.includes('secret')) { console.log('[*] Found secret: ' + str); } return this.$init(str); }; }); """) script.load() device.resume(pid) sys.stdin.read() ``` ## Troubleshooting ### Magisk Not Showing Root ```bash # Verify Magisk installation adb shell ls -la /data/adb/magisk/ # Check Magisk daemon adb shell su -c "magisk --version" # Reinstall via rootAVD cd rootAVD ./rootAVD.sh system-images/android-36.1/google_apis/arm64-v8a/ramdisk.img restore ./rootAVD.sh system-images/android-36.1/google_apis/arm64-v8a/ramdisk.img ``` ### Frida Server Crashes ```bash # Check architecture match adb shell getprop ro.product.cpu.abi # Should be arm64-v8a # Kill existing server adb shell "su -c 'killall frida-server'" # Restart with debug output adb shell "su -c '/data/local/tmp/frida-server -D'" ``` ### LSPosed Not Working ```bash # Verify Zygisk is enabled adb shell su -c "magisk --sqlite 'SELECT * FROM settings WHERE key=\"zygisk\"'" # Check LSPosed installation adb shell ls -la /data/adb/lspd/ # Clear LSPosed cache adb shell su -c "rm -rf /data/adb/lspd/cache" adb reboot ``` ### SSL Pinning Bypass Not Working ```bash # Ensure modules are activated for target app # LSPosed Manager → Modules → TrustMeAlready → Check target app # Try alternative: disable pinning via Frida frida -U -f com.example.app --codeshare akabe1/frida-multiple-unpinning # Verify certificate installation adb shell "su -c 'ls -la /system/etc/security/cacerts/'" ``` ### Emulator Boot Loop After Root ```bash # Restore from snapshot if created # Android Studio → Device Manager → Snapshots → Restore # Or restore original ramdisk cd rootAVD