> For the complete documentation index, see [llms.txt](https://pcastagnaro.gitbook.io/pentest-bug-bounty-resources/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pcastagnaro.gitbook.io/pentest-bug-bounty-resources/pentest-bounty-resources/mobile/android/create-a-lab/rooting-android-emulator.md).

# Rooting Android Emulator

## **Requirements**:

* Android Studio Installed
* An Android Emulator running (for this tutorial version 5.1 -API 21-)
* SuperSU Mobile app (chainfire)
  * [Google Play Store](https://play.google.com/store/apps/details?id=eu.chainfire.supersu)
  * [Direct Download](https://supersuroot.org/download/) (called SuperSU APK)
* Recovery **flashable.zip**
  * [Direct Download](https://supersuroot.org/download/) (called SuperSU ZIP)
  * [Alternative backup](https://androidfilehost.com/?w=files\&flid=154643) provided by XDA user [Ibuprophen](https://forum.xda-developers.com/member.php?u=4828250)

## **Instructions**

### **Install the SuperSu.apk**

* Install the SuperSu app firstly.
  * You can do it from the device from [Google Play Store](https://play.google.com/store/apps/details?id=eu.chainfire.supersu), or
  * Sideload through adb i.e `adb -e install supersu.apk`
* After installing it, when you run it shows a screen as shown below indicating "There is no SU binary installed..". This error just confirms the device is not yet rooted.

### **Make emulator’ system partition writable**

* As it suggests, we need to give the emulator permission to write system files.
* List the emulators installed on your PC `emulator -list-avds`

![Emulator list](https://532189072-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Lt8335BPUBXjq3iC572%2F-MKDFVCNP5QUSujWifvx%2F-MKDHG-kGhXAcA1ZGtPz%2Fimage.png?alt=media\&token=af72ff88-af3a-45fd-bffe-0d6672c70080)

* Navigate to the **tools** folder where Android SDK is installed and open command prompt there.
  * On Mac OS: `~/Library/Android/sdk/emulator`
* Type the following code to accomplish this: `emulator -avd {emulator_name} -writable-system`

![](https://532189072-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Lt8335BPUBXjq3iC572%2F-MKDFVCNP5QUSujWifvx%2F-MKDIFx0E8XnPbr3vq-c%2Fimage.png?alt=media\&token=d1012900-583a-4584-8294-d836ff7497df)

### **Pushing su binary in system directory**

* Extract the Recovery **flashable.zip** (containing the su binaries of different architectures)

{% hint style="danger" %}
Important! Only use the su binary that matches your AVD architecture e.g x86, arm etc.., and note the path where you extracted these binaries.
{% endhint %}

![](https://532189072-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Lt8335BPUBXjq3iC572%2F-MKDFVCNP5QUSujWifvx%2F-MKDIyCKECrgGeMceJLw%2Fimage.png?alt=media\&token=c17b13ac-91f0-4b53-96f7-2c4560ad8517)

* Make sure you are running adb as root and also you need to remount. Just enter these codes

```
adb root
adb remount
```

![](https://532189072-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Lt8335BPUBXjq3iC572%2F-MKDFVCNP5QUSujWifvx%2F-MKDJJnLtG4s5rtJtk9J%2Fimage.png?alt=media\&token=593700da-1ebc-4231-bf19-b3b99c4f2f93)

* Now its time to push the su binary:

![](https://532189072-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Lt8335BPUBXjq3iC572%2F-MKDFVCNP5QUSujWifvx%2F-MKDJTvbYCCqpTLmO9D1%2Fimage.png?alt=media\&token=21813a6f-a0b5-4ee9-b357-0c6a91a8a96b)

`adb -e push adb -e push UPDATE-SuperSU-v2.82-20170528234214/x64/su /system/xbin/su`

{% hint style="info" %}
Nevermind about my specific location of su binary, any location is okay as long there is no white space
{% endhint %}

{% hint style="warning" %}
To figure out **bin** or **xbin** do in console before:

`adb shell`\
`ls /system/xbin/su`
{% endhint %}

{% hint style="info" %}
For emulators running android 5.1 and below use the `su` and not `su.pie`
{% endhint %}

### **Change permissions of the su binary**

* Next let's do a bit of modification of the permissions of su binary. We have to do this in emulator device through adb:

```
adb -e shell su root cd /system/xbin chmod 06755 su
```

![](https://532189072-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Lt8335BPUBXjq3iC572%2F-MKDFVCNP5QUSujWifvx%2F-MKDK_qnnRb8AinBIB_Y%2Fimage.png?alt=media\&token=e5bb748c-3dec-4214-895b-1c732d24dce2)

{% hint style="warning" %}
Take note of su binary path (mine is `/system/xbin`)
{% endhint %}

* Setting the `install` directive on su binary and set a `daemon`

```
su --install
su --daemon&
```

![](https://532189072-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Lt8335BPUBXjq3iC572%2F-MKDFVCNP5QUSujWifvx%2F-MKDKvgvftcB8ixdvNrs%2Fimage.png?alt=media\&token=51cff8da-83b6-461a-a354-a063a94da03e)

### **Setting SELinux to Permissive (i.e turning off SE Linux)**

* Finally turn off selinux through this code: `setenforce 0`
* Open SuperSU app on the Mobile emulator and it may ask to update binaries, you can use Normal method.

![](https://532189072-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Lt8335BPUBXjq3iC572%2F-MKDFVCNP5QUSujWifvx%2F-MKDLC1JQ-ezQ2DtNFFx%2Fimage.png?alt=media\&token=3b8b3ffa-9086-4c4c-a78d-58621550932c)

{% hint style="info" %}
If you're experiencing bootloops, rather don't update the binaries, just use it as it is.
{% endhint %}

### Now you have an emulator with root!

![](https://532189072-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Lt8335BPUBXjq3iC572%2F-MKDFVCNP5QUSujWifvx%2F-MKDLTtwVVR7GAQqRJhS%2Fimage.png?alt=media\&token=c42a907e-d18e-42b1-b5c0-395fe52e460f)