> For the complete documentation index, see [llms.txt](https://pcastagnaro.gitbook.io/pentest-bug-bounty-resources/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pcastagnaro.gitbook.io/pentest-bug-bounty-resources/pentest-bounty-resources/mobile/android/dast-1/rooting-the-android-studio-avds.md).

# Rooting the Android Studio AVDs

From https\://github.com/0xFireball/root\_avd/

A quick guide on how to root Android Studio's Android AVDs (and required files!)

Required files can be found in this repository: <https://github.com/0xFireball/root_avd>

You need the Android SDK and fresh new AVD. For this guide we will call it `RootAVD`.

This was written and tested on a Nexus 5X AVD running Android 7.1 Nougat on an Ubuntu Linux host. This method *should* work with a similar setup (Android Nougat) for the forseeable future, though future Android versions may complicate this process further.

1.) Start emulator `$SDK_PATH/emulator/emulator` with args `-avd RootAVD -writable-system -selinux disabled -qemu -enable-kvm`

{% tabs %}
{% tab title="Windows" %}
{% code overflow="wrap" lineNumbers="true" %}

```bash
C:\Users\<USER>\AppData\Local\Android\Sdk\emulator\emulator -avd RootAPI27 -writable-system -selinux disabled -qemu
```

{% endcode %}
{% endtab %}

{% tab title="MacOS" %}
{% code overflow="wrap" lineNumbers="true" %}

```bash
~/Library/Android/sdk/emulator/emulator -avd RootAPI27 -writable-system
```

{% endcode %}
{% endtab %}
{% endtabs %}

{% hint style="info" %}
`RootAPI27` is the AVD name you had created

![](https://532189072-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lt8335BPUBXjq3iC572%2Fuploads%2FKo3xzOtOOpbcJoWwhuDt%2Fimage.png?alt=media\&token=f45b65bb-ce45-4610-a4f6-e6b550c7bee2)
{% endhint %}

<figure><img src="https://532189072-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lt8335BPUBXjq3iC572%2Fuploads%2F8OCTSSzaKtdwcBtWyPQD%2Fimage.png?alt=media&amp;token=d8194285-aa36-43c8-ad9e-6e1a7c3fd66d" alt=""><figcaption></figcaption></figure>

2.) Wait for boot

3.) Restart `adbd` as root and remount system as writable:

```
adb root
adb remount
```

<figure><img src="https://532189072-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lt8335BPUBXjq3iC572%2Fuploads%2FIPU99FGl0llNPb3GAIYI%2Fimage.png?alt=media&amp;token=a661e819-1af6-412d-96f1-6bbd852f04c5" alt=""><figcaption></figcaption></figure>

4.) Install `Superuser.apk`:

`adb install SuperSU/common/Superuser.apk`

5.) Push `su` and update permissions: you will have to pick the corresponding architecture `$ARCH`. `adb push SuperSU/$ARCH/su /system/xbin/su`, then update permissions: `adb shell chmod 0755 /system/xbin/su`

{% tabs %}
{% tab title="Windows" %}
{% code overflow="wrap" lineNumbers="true" %}

```bash
adb push <LOCAL PATH>\su /system/xbin/su

# update permissions
adb shell chmod 0755 /system/xbin/su
```

{% endcode %}
{% endtab %}

{% tab title="MacOS" %}
{% code overflow="wrap" lineNumbers="true" %}

```bash
adb push <LOCAL PATH>/su /system/xbin/su

# update permissions
adb shell chmod 0755 /system/xbin/su
```

{% endcode %}
{% endtab %}
{% endtabs %}

6.) Enter into `adb` shell: `adb shell`

{% tabs %}
{% tab title="ADB Shell" %}
{% code overflow="wrap" lineNumbers="true" %}

```bash
#Set SELinux Permissive
setenforce 0

#Install SuperSU's su to system
su --install

#Run SuperSU's su as daemon
su --daemon&

#Exit adb shell
exit
```

{% endcode %}
{% endtab %}
{% endtabs %}

7.) Install [Superuser.apk](https://github.com/0xFireball/root_avd/blob/master/SuperSU/common/Superuser.apk) application

```bash
adb install .\Superuser.apk
```

8.) Finally, open the SuperSU app on the device, and it will tell you the `su` binary needs to be updated. Accept and use normal installation.

Installation will fail. Don't reboot, just move on. It will still work.

9.) Congratulations! You now have a rooted AVD with SuperSU.

<figure><img src="https://532189072-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lt8335BPUBXjq3iC572%2Fuploads%2F7DMgJDSJp677JOB2Et3A%2Fimage.png?alt=media&amp;token=96711058-dfb3-426f-8d2d-f69f12f25ee4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://532189072-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lt8335BPUBXjq3iC572%2Fuploads%2FOmp5uiyRUIcPaqS2OJXc%2Fimage.png?alt=media&amp;token=af0abb19-2133-45c3-854c-1c370765cb11" alt=""><figcaption></figcaption></figure>

**TIP: Superuser may not always persist after reboot, to fix:**

1. From a root shell, start `su --daemon&`
2. Root should now work.
3. Optional: Look for the temporary emulator system image; you can back this up and use it as a patched system.