android-pentest-environment-setup

name	android-pentest-environment-setup
description	Complete Android app penetration testing environment setup with Android Studio, rooted emulator, Magisk, and reverse engineering tools
triggers	["how do I set up an Android pentesting environment","configure Android emulator for app security testing","root Android Studio emulator with Magisk","install frida on rooted Android emulator","setup Android app reverse engineering environment","configure proxy for Android app traffic interception","bypass Android SSL pinning with Magisk modules","setup ADB for Android security testing"]

Android Penetration Testing Environment Setup

Skill by ara.so — Security Skills collection.

This skill covers setting up a complete Android application penetration testing environment using Android Studio emulators, including rooting with Magisk, installing security testing frameworks (Frida, LSPosed), and configuring traffic interception tools.

What This Project Provides

A comprehensive guide to building a modern (2026) Android app penetration testing lab environment on Android Studio, including:

• Android Studio AVD (Android Virtual Device) configuration optimized for security testing
• Root access via Magisk framework
• Frida dynamic instrumentation framework
• LSPosed/Xposed module framework for runtime hooking
• SSL/TLS certificate pinning bypass capabilities
• Traffic interception setup with Burp Suite/mitmproxy
• Anti-emulator detection bypass techniques

Key Advantages:

• Reproducible environment using snapshots
• No need for physical devices
• Full system access for deep analysis
• Support for Android 16 (API 36)

Limitations:

• Some apps detect emulators and refuse to run
• Performance may be slower than physical devices

Prerequisites

• macOS, Linux, or Windows
• 16GB+ RAM recommended
• Android Studio installed
• Proxy tool (Burp Suite, mitmproxy, Charles) for traffic analysis

Installation

1. Install Android Studio and SDK

# macOS/Linux - Download from official site
# https://developer.android.google.cn/studio

# After installation, configure SDK path (default recommended)
# macOS: ~/Library/Android/sdk
# Linux: ~/Android/Sdk
# Windows: %LOCALAPPDATA%\Android\Sdk

# Set environment variables (macOS/Linux bash)
cat >> ~/.bash_profile << 'EOF'
export ANDROID_HOME=$HOME/Library/Android/sdk
export PATH=$PATH:$ANDROID_HOME/platform-tools
export PATH=$PATH:$ANDROID_HOME/tools
export PATH=$PATH:$ANDROID_HOME/tools/bin
export PATH=$PATH:$ANDROID_HOME/emulator
EOF

source ~/.bash_profile

# For zsh users
cat >> ~/.zshrc << 'EOF'
export ANDROID_HOME=$HOME/Library/Android/sdk
export PATH=$PATH:$ANDROID_HOME/platform-tools
export PATH=$PATH:$ANDROID_HOME/tools
export PATH=$PATH:$ANDROID_HOME/tools/bin
export PATH=$PATH:$ANDROID_HOME/emulator
EOF

source ~/.zshrc

# Verify ADB is accessible
adb version

Windows PowerShell:

# Add to System Environment Variables
[Environment]::SetEnvironmentVariable("ANDROID_HOME", "$env:LOCALAPPDATA\Android\Sdk", "User")
$path = [Environment]::GetEnvironmentVariable("Path", "User")
[Environment]::SetEnvironmentVariable("Path", "$path;$env:ANDROID_HOME\platform-tools;$env:ANDROID_HOME\tools", "User")

2. Create Android Virtual Device (AVD)

# List available system images
sdkmanager --list | grep system-images

# Install Android 16 (API 36) Google APIs ARM64
sdkmanager "system-images;android-36;google_apis;arm64-v8a"

# Create AVD via command line (alternative to GUI)
avdmanager create avd \
  -n pentest_pixel9 \
  -k "system-images;android-36;google_apis;arm64-v8a" \
  -d "pixel_9_pro"

# Or use Android Studio GUI:
# More Actions → Virtual Device Manager → Create Device
# - Device: Pixel 9 Pro
# - System Image: API 36 (Android 16), Google APIs, arm64-v8a
# - Configuration:
#   * RAM: 4096 MB
#   * Internal Storage: 16384 MB
#   * VM heap: 512 MB
#   * Boot option: Cold Boot

Important: Choose Google APIs (NOT Google Play) to allow root access.

3. Root with Magisk (Method A: rootAVD - Recommended)

# Clone rootAVD tool
git clone https://gitlab.com/newbit/rootAVD.git
cd rootAVD

# Download latest Magisk APK and rename to Magisk.zip
# https://github.com/topjohnwu/Magisk/releases
curl -L -o Magisk.zip https://github.com/topjohnwu/Magisk/releases/download/v28.1/Magisk-v28.1.apk

# List available AVDs
./rootAVD.sh ListAllAVDs

# Root the specific system image
./rootAVD.sh system-images/android-36/google_apis/arm64-v8a/ramdisk.img

# Start emulator (will auto-install Magisk)
emulator -avd pentest_pixel9 -writable-system

# Verify root
adb shell su -c "id"
# Expected output: uid=0(root) gid=0(root)

4. Root with Magisk (Method B: Manual Patch - If rootAVD Fails)

# Start emulator with writable system
emulator -avd pentest_pixel9 -writable-system &
sleep 30
adb root
adb remount

# Install Magisk APK
adb install Magisk-v28.1.apk

# Push ramdisk to device
RAMDISK="$ANDROID_HOME/system-images/android-36/google_apis/arm64-v8a/ramdisk.img"
adb push "$RAMDISK" /sdcard/Download/ramdisk.img

# In Magisk app: Install → Select and Patch a File → Choose ramdisk.img
# Wait for patching to complete

# Pull patched ramdisk
adb pull /sdcard/Download/magisk_patched_*.img ./

# Replace original ramdisk
cp magisk_patched_*.img "$ANDROID_HOME/system-images/android-36/google_apis/arm64-v8a/ramdisk.img"

# Restart emulator
adb reboot

Key Commands

ADB (Android Debug Bridge)

# List connected devices
adb devices

# Connect to specific emulator
adb -s emulator-5554 shell

# Install APK
adb install app.apk
adb install -r app.apk  # Reinstall keeping data

# Pull/Push files
adb pull /data/data/com.example.app/databases/app.db ./
adb push burp-cert.der /sdcard/

# Forward ports
adb forward tcp:8080 tcp:8080

# Get root shell
adb root
adb shell

# Remount system as writable
adb remount

# Log viewing
adb logcat | grep -i "com.example.app"
adb logcat -c  # Clear logs

# Screen capture
adb shell screencap /sdcard/screen.png
adb pull /sdcard/screen.png

# Start/Stop app
adb shell am start -n com.example.app/.MainActivity
adb shell am force-stop com.example.app

Magisk Module Management

# Install module via ADB
adb push module.zip /sdcard/Download/
adb shell su -c "magisk --install-module /sdcard/Download/module.zip"

# List installed modules
adb shell su -c "ls /data/adb/modules"

# Enable Zygisk (required for LSPosed)
adb shell su -c "magisk --sqlite 'UPDATE settings SET value=1 WHERE key=\"zygisk\"'"
adb reboot

# Check Magisk status
adb shell su -c "magisk -v"

Installing Security Testing Frameworks

1. Install Frida

# Get Android architecture
adb shell getprop ro.product.cpu.abi
# Output: arm64-v8a

# Download Frida server (match version with frida-tools)
FRIDA_VERSION=$(pip3 show frida | grep Version | cut -d' ' -f2)
wget "https://github.com/frida/frida/releases/download/${FRIDA_VERSION}/frida-server-${FRIDA_VERSION}-android-arm64.xz"
unxz frida-server-*-android-arm64.xz

# Push to device
adb root
adb push frida-server-*-android-arm64 /data/local/tmp/frida-server
adb shell chmod 755 /data/local/tmp/frida-server

# Start Frida server
adb shell "/data/local/tmp/frida-server &"

# Verify on host
pip3 install frida-tools
frida-ps -U
# Should list running processes

Persistent Frida with Magisk Module:

# Create Magisk module structure
mkdir -p frida-module/system/bin
cp frida-server-*-android-arm64 frida-module/system/bin/frida-server

# Create module.prop
cat > frida-module/module.prop << 'EOF'
id=frida_server
name=Frida Server
version=16.5.0
versionCode=16050
author=Frida
description=Frida dynamic instrumentation toolkit
EOF

# Create service script
cat > frida-module/service.sh << 'EOF'
#!/system/bin/sh
/system/bin/frida-server &
EOF

# Package and install
cd frida-module
zip -r ../frida-module.zip .
adb push ../frida-module.zip /sdcard/
adb shell su -c "magisk --install-module /sdcard/frida-module.zip"
adb reboot

2. Install LSPosed (Xposed Framework)

# Download LSPosed Zygisk version
# https://github.com/LSPosed/LSPosed/releases
wget https://github.com/LSPosed/LSPosed/releases/download/v1.9.2/LSPosed-v1.9.2-7024-zygisk-release.zip

# Install via Magisk
adb push LSPosed-v1.9.2-7024-zygisk-release.zip /sdcard/
adb shell su -c "magisk --install-module /sdcard/LSPosed-v1.9.2-7024-zygisk-release.zip"
adb reboot

# Access LSPosed Manager (after reboot)
# Notification will appear, or run:
adb shell am start -n org.lsposed.manager/.ui.activity.MainActivity

Common LSPosed Modules for Pentesting:

# TrustMeAlready - Bypass SSL pinning
# https://github.com/ViRb3/TrustMeAlready/releases

# JustTrustMe - Alternative SSL bypass
# Install via LSPosed Manager → Repository

# XPrivacyLua - Privacy/permission control
# Useful for testing permission bypasses

3. Install ZygiskNext (Improved Zygisk)

# Download ZygiskNext
wget https://github.com/Dr-TSNG/ZygiskNext/releases/download/v4.0.1/Zygisk-Next-4.0.1-release.zip

# Disable built-in Zygisk first
adb shell su -c "magisk --sqlite 'UPDATE settings SET value=0 WHERE key=\"zygisk\"'"

# Install ZygiskNext
adb push Zygisk-Next-4.0.1-release.zip /sdcard/
adb shell su -c "magisk --install-module /sdcard/Zygisk-Next-4.0.1-release.zip"
adb reboot

SSL/TLS Certificate Pinning Bypass

Method 1: System Certificate Installation

# Convert PEM cert to Android format
openssl x509 -inform PEM -subject_hash_old -in burp-cert.pem | head -1
# Output: 9a5ba575

# Rename cert
cp burp-cert.pem 9a5ba575.0

# Push to system store
adb root
adb remount
adb push 9a5ba575.0 /system/etc/security/cacerts/
adb shell chmod 644 /system/etc/security/cacerts/9a5ba575.0
adb reboot

Method 2: Using Magisk Modules

Install TrustMeAlready:

# Download from LSPosed Manager or:
adb push TrustMeAlready.apk /sdcard/
adb install /sdcard/TrustMeAlready.apk

# Enable in LSPosed:
# 1. Open LSPosed Manager
# 2. Modules → TrustMeAlready → Enable
# 3. Select target apps
# 4. Reboot

Install Shamiko (Hide root from apps):

wget https://github.com/LSPosed/LSPosed.github.io/releases/download/shamiko-354/Shamiko-v0.7.4-354-release.zip
adb push Shamiko-v0.7.4-354-release.zip /sdcard/
adb shell su -c "magisk --install-module /sdcard/Shamiko-v0.7.4-354-release.zip"
adb reboot

Traffic Interception Setup

Configure Proxy on Emulator

# Method 1: Via ADB (requires root)
adb shell settings put global http_proxy <HOST_IP>:8080

# Method 2: Via emulator settings
# Settings → Network & Internet → Wi-Fi → AndroidWifi → 
# Proxy → Manual → Hostname: <HOST_IP>, Port: 8080

# Disable proxy
adb shell settings put global http_proxy :0

# Verify proxy settings
adb shell settings get global http_proxy

Burp Suite Configuration

# 1. Export Burp CA certificate (DER format)
# Proxy → Options → Import/Export CA Certificate → Export DER

# 2. Push to emulator
adb push burp-cert.der /sdcard/

# 3. Install via Settings
# Settings → Security → Install from SD card → Select burp-cert.der

# 4. For system-level trust (Android 7+)
openssl x509 -inform DER -in burp-cert.der -out burp-cert.pem
openssl x509 -inform PEM -subject_hash_old -in burp-cert.pem | head -1
# e.g., output: 9a5ba575
cp burp-cert.pem 9a5ba575.0

adb root
adb remount
adb push 9a5ba575.0 /system/etc/security/cacerts/
adb shell chmod 644 /system/etc/security/cacerts/9a5ba575.0
adb reboot

Frida Scripts for Common Tasks

Bypass SSL Pinning (Universal Script)

// ssl-pinning-bypass.js
Java.perform(function() {
    console.log("[*] Bypassing SSL Pinning...");
    
    // OkHttp3
    try {
        var CertificatePinner = Java.use('okhttp3.CertificatePinner');
        CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function() {
            console.log('[+] OkHttp3 pinning bypassed');
            return;
        };
    } catch(err) {
        console.log('[-] OkHttp3 not found');
    }
    
    // TrustManager
    var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
    var SSLContext = Java.use('javax.net.ssl.SSLContext');
    
    var TrustManager = Java.registerClass({
        name: 'dev.asd.test.TrustManager',
        implements: [X509TrustManager],
        methods: {
            checkClientTrusted: function(chain, authType) {},
            checkServerTrusted: function(chain, authType) {},
            getAcceptedIssuers: function() { return []; }
        }
    });
    
    var TrustManagers = [TrustManager.$new()];
    var SSLContext_init = SSLContext.init.overload(
        '[Ljavax.net.ssl.KeyManager;', '[Ljavax.net.ssl.TrustManager;', 'java.security.SecureRandom'
    );
    
    SSLContext_init.implementation = function(keyManager, trustManager, secureRandom) {
        console.log('[+] TrustManager bypassed');
        SSLContext_init.call(this, keyManager, TrustManagers, secureRandom);
    };
});

Run the script:

frida -U -f com.example.app -l ssl-pinning-bypass.js --no-pause

Extract Shared Preferences

// extract-prefs.js
Java.perform(function() {
    var context = Java.use('android.app.ActivityThread')
        .currentApplication()
        .getApplicationContext();
    
    var prefsDir = context.getFilesDir().getParent() + '/shared_prefs';
    console.log('[*] Shared Preferences location:', prefsDir);
    
    var File = Java.use('java.io.File');
    var dir = File.$new(prefsDir);
    var files = dir.listFiles();
    
    for (var i = 0; i < files.length; i++) {
        console.log('[+] Found:', files[i].getName());
    }
});

Hook Crypto Functions

// crypto-hook.js
Java.perform(function() {
    var Cipher = Java.use('javax.crypto.Cipher');
    
    Cipher.doFinal.overload('[B').implementation = function(byteArr) {
        console.log('[*] Cipher.doFinal called');
        console.log('[*] Algorithm:', this.getAlgorithm());
        console.log('[*] Input:', Java.use('android.util.Base64')
            .encodeToString(byteArr, 0));
        
        var result = this.doFinal(byteArr);
        console.log('[*] Output:', Java.use('android.util.Base64')
            .encodeToString(result, 0));
        return result;
    };
});

Troubleshooting

Emulator Won't Start

# Check available resources
emulator -list-avds
emulator -avd pentest_pixel9 -verbose

# Try cold boot
emulator -avd pentest_pixel9 -no-snapshot-load

# Wipe data if corrupted
emulator -avd pentest_pixel9 -wipe-data

ADB Can't Connect

# Kill and restart ADB server
adb kill-server
adb start-server

# Check emulator port
adb devices
# emulator-5554 device

# Manually connect
adb connect localhost:5554

Magisk Not Working After Reboot

# Re-run rootAVD
cd rootAVD
./rootAVD.sh system-images/android-36/google_apis/arm64-v8a/ramdisk.img

# Or restore from snapshot before rooting

Frida Connection Issues

# Ensure frida-server is running
adb shell "ps | grep frida-server"

# Kill and restart
adb shell "pkill frida-server"
adb shell "/data/local/tmp/frida-server &"

# Check port forwarding
adb forward tcp:27042 tcp:27042

# Verify version match
frida --version
adb shell /data/local/tmp/frida-server --version

LSPosed Not Appearing

# Verify Zygisk is enabled
adb shell su -c "magisk --sqlite 'SELECT * FROM settings WHERE key=\"zygisk\"'"
# Should show value=1

# Check module status
adb shell su -c "ls -la /data/adb/modules/zygisk_lsposed"

# View logs
adb logcat | grep -i lsposed

App Detects Emulator

Use Shamiko + DenyList:

# Enable Shamiko (if not already)
# Configure DenyList in Magisk
adb shell su -c "magisk --denylist add com.example.app"
adb shell su -c "magisk --denylist enable"

# Hide Magisk app itself
# Magisk → Settings → Hide Magisk App → Random package name

Modify build.prop:

adb root
adb remount
adb pull /system/build.prop

# Edit locally, change:
# ro.product.manufacturer=Google
# ro.product.model=Pixel 9 Pro
# ro.build.fingerprint=google/...

adb push build.prop /system/build.prop
adb reboot

SSL Pinning Still Active

# Try multiple bypass methods simultaneously
frida -U -f com.example.app \
  -l ssl-pinning-bypass.js \
  -l universal-ssl-bypass.js \
  --no-pause

# Enable TrustMeAlready in LSPosed for target app
# Reboot and test again

Advanced Configuration

Create Snapshot After Setup

# Via Android Studio GUI
# Virtual Device Manager → AVD → Dropdown → Snapshots → Take Snapshot

# Via command line (emulator must be running)
adb shell "sync; echo 3 > /proc/sys/vm/drop_caches"
# Then use GUI to snapshot

Automated Environment Setup Script

#!/bin/bash
# setup-pentest-env.sh

AVD_NAME="pentest_pixel9"
ANDROID_API="android-36"
ARCH="arm64-v8a"

echo "[*] Setting up Android Pentest Environment..."

# Install system image
sdkmanager "system-images;${ANDROID_API};google_apis;${ARCH}"

# Create AVD
avdmanager create avd -n ${AVD_NAME} \
  -k "system-images;${ANDROID_API};google_apis;${ARCH}" \
  -d "pixel_9_pro" --force

# Root with rootAVD
cd rootAVD
./rootAVD.sh system-images/${ANDROID_API}/google_apis/${ARCH}/ramdisk.img

# Start emulator
emulator -avd ${AVD_NAME} -writable-system &
sleep 60

# Install Frida
FRIDA_VERSION=$(pip3 show frida | grep Version | awk '{print $2}')
wget -q "https://github.com/frida/frida/releases/download/${FRIDA_VERSION}/frida-server-${FRIDA_VERSION}-android-${ARCH}.xz"
unxz frida-server-*.xz
adb root
adb push frida-server-* /data/local/tmp/frida-server
adb shell chmod 755 /data/local/tmp/frida-server
adb shell "/data/local/tmp/frida-server &"

echo "[+] Setup complete. Connect via: adb -s emulator-5554 shell"

References

• Original project: https://github.com/d0ctorsec/AndroidStudioAppPentestEnvironmentSetup
• rootAVD: https://gitlab.com/newbit/rootAVD
• Magisk: https://github.com/topjohnwu/Magisk
• Frida: https://frida.re
• LSPosed: https://github.com/LSPosed/LSPosed