AERoot is a command line tool that allows you to give the root privileges on-the-fly to any process running on the Android emulator with Google Play flavors AVDs.

This project is a rewrite from scratch of the android-emuroot tool (https://github.com/airbus-seclab/android_emuroot). It comes with new features:

• Recent AVDs support (Android API > 27)
• Execution time optimization
• Selection of a process by its PID

Compatible Kernels

Requirements

AERoot requires gdb (with Python support enabled) to run properly.

Installation

Last Release

pip install aeroot

Current version

git clone https://github.com/quarkslab/AERoot.git

python3 setup.py install --user

Docker

A Docker image of AERoot is available on dockerhub.

Also, you can build an image by yourself:

docker build -t aeroot https://github.com/quarkslab/AERoot.git

Linux

Usage

docker run --rm \
           -v $HOME/.emulator_console_auth_token:$HOME/.emulator_console_auth_token \
           --network host \
           ha0ris/aeroot [aeroot options]

Example

docker run --rm \
           -v $HOME/.emulator_console_auth_token:$HOME/.emulator_console_auth_token \
           --network host \
           ha0ris/aeroot daemon

macOS

Usage

docker run --rm \
           -v $HOME/.emulator_console_auth_token:$HOME/.emulator_console_auth_token \
           ha0ris/aeroot --host host.docker.internal [aeroot options]

Example

docker run --rm \
           -v $HOME/.emulator_console_auth_token:$HOME/.emulator_console_auth_token \
           ha0ris/aeroot --host host.docker.internal daemon

Quick-start

First of all, you must launch the Android emulator with the gdb qemu option (-qemu -s).

emulator @Your_AVD -qemu -s

Then run aeroot by choosing the mode among:

• pid: give the root privileges to a process selected by its PID.
• name: give the root privileges to a process selected by its name.
• daemon: give the root privileges to the ADB daemon, so shells created with adb shell will automaticaly have root rigths.

Usage

aeroot [-h] [--verbose | --quiet] [--device DEVICE] [--host HOST] [--port PORT] {name,pid,daemon} ...

Examples

pid mode example

aeroot pid 1337

Gives the root privileges to the process with pid 1337

name mode example

aeroot name my_process

Gives the root privileges to the process named "my_process"

daemon mode example

aeroot daemon

Gives the root privileges to the ADB daemon

Additional options

You can find additional options by checking the help of the tool: aeroot -h