rootbeer

This repository contains Xamarin.Android bindings for the original rootbeer library.

🔒📌 Note: I highly encourage you to install BreachDetector instead, which will allow you to work in a cross platform way.

---

RootBeer

A tasty root checker library and sample app. We've scoured the internets for different methods of answering that age old question... Has this device got root?

Setup

Download the package from NuGet.

Install-Package RootBeer

Root checks

These are the current checks/tricks we are using to give an indication of root.

Code checks

• CheckRootManagementApps
• CheckPotentiallyDangerousApps
• CheckRootCloakingApps
• CheckTestKeys
• CheckForDangerousProps
• CheckForBusyBoxBinary
• CheckForSuBinary
• CheckSuExists
• CheckForRWSystem

Native checks

We call through to our native root checker to run some of its own checks. Native checks are typically harder to cloak, so some root cloak apps just block the loading of native libraries that contain certain keywords.

• CheckForSuBinary

Disclaimer and limitations!

Authors love root! both Scott and Mat (the creators and main contributors) use rooted devices. But they appreciate sometimes you might want to have a indication your app is running on a rooted handset. Plus they wanted to see if they could beat the root cloakers. So that's what this library gives you, an indication of root.

Remember root==god, so there's no 100% way to check for root.

Root cloakers

The Rootbeer lib shows an indication of root when testing with the following root cloak apps. However Rootbeer is defeated when using a combination of the root cloakers activated at the same time.

Tested cloakers:

• RootCloak Plus (Cydia) requires Cydia Substrate
• RootCloak - requires Xposed Framework

Usage

using Com.Scottyab.Rootbeer;

var rootBeer = new RootBeer(context);
if (rootBeer.IsRooted)
{
    //we found indication of root
}
else
{
    //we didn't find indication of root
}

You can also call each of the checks individually as the sample app does.

False positives

Manufacturers often leave the busybox binary in production builds and this doesn't always mean that a device is root. We have removed the busybox check we used to include as standard in the IsRooted method to avoid these false positives.

If you want to detect the busybox binary in your app you can use CheckForBinary(BINARY_BUSYBOX) to detect it alone, or as part of the complete root detection method:

rootBeer.IsRootedWithBusyBoxCheck;

The following devices are known the have the busybox binary present on the stock rom:

• All OnePlus Devices
• Moto E
• OPPO R9m (ColorOS 3.0,Android 5.1,Android security patch January 5, 2018 )

Contributing

Yes please :)

Thanks

• Scott and Mat, main contributors of rootbeer
• Kevin Kowalewski and others from this popular StackOverflow post
• Eric Gruber's - Android Root Detection Techniques article

Other libraries

If you dig this, you might like:

• Tim Strazzere's Anti emulator checks project
• Scott Alexander-Bown's SafetyNet Helper library - coupled with server side validation this is one of the best root detection approaches. See the Google SafetyNet helper docs.

Licence

This binding library is licensed under MIT.