android-app-pentest-environment

Android App Penetration Testing Environment

Skill by ara.so — Security Skills collection.

This skill enables AI agents to help developers set up a complete Android application penetration testing environment using Android Studio emulators with root access, Magisk modules, SSL certificate management, and traffic interception capabilities.

What This Project Provides

A comprehensive guide and toolset for creating a 2026-ready Android app security testing environment including:

• Rooted Android emulator (API 36 / Android 16)
• Magisk (面具) for root management and module support
• SSL/TLS certificate bypasses for traffic interception
• Xposed framework integration
• Frida dynamic instrumentation setup
• BurpSuite/Charles proxy configuration

Prerequisites

Install Android Studio and SDK

# Download Android Studio from official site
# https://developer.android.google.cn/studio?hl=zh-cn

# After installation, configure proxy if needed (for faster downloads)
# Settings → Appearance & Behavior → System Settings → HTTP Proxy
# Example: 127.0.0.1:7890 for ClashX

# SDK will auto-install at:
# macOS: /Users/$USER/Library/Android/sdk
# Windows: C:\Users\$USER\AppData\Local\Android\Sdk
# Linux: ~/Android/Sdk

Configure Environment Variables

macOS/Linux (bash):

# Edit ~/.bash_profile or ~/.zshrc
export ANDROID_HOME=$HOME/Library/Android/sdk
export PATH=$PATH:$ANDROID_HOME/platform-tools
export PATH=$PATH:$ANDROID_HOME/tools
export PATH=$PATH:$ANDROID_HOME/tools/bin
export PATH=$PATH:$ANDROID_HOME/emulator

# Apply changes
source ~/.bash_profile  # or ~/.zshrc

Windows (PowerShell):

# Add to system environment variables
setx ANDROID_HOME "C:\Users\$env:USERNAME\AppData\Local\Android\Sdk"
setx PATH "$env:PATH;$env:ANDROID_HOME\platform-tools;$env:ANDROID_HOME\emulator"

Verify ADB Installation

# Test ADB is accessible
adb version
# Output: Android Debug Bridge version 1.0.41

Create Android Emulator

Recommended Configuration

# Launch Android Studio → More Actions → Virtual Device Manager → Create Device

# Recommended specs:
# Device: Pixel 9 Pro
# System Image: API 36 (Android 16), Google APIs, arm64-v8a
# ⚠️ Use Google APIs (NOT Google Play - allows root)

# Advanced settings:
# - Boot option: Cold Boot
# - Internal Storage: 16 GB
# - SD Card: 4 GB
# - RAM: 4096 MB (minimum)
# - VM Heap: 512 MB

Launch Emulator via CLI

# List available AVDs
emulator -list-avds

# Start specific AVD
emulator -avd Pixel_9_Pro_API_36 &

# Start with writable system (for manual modifications)
emulator -avd Pixel_9_Pro_API_36 -writable-system &

Install Magisk (Root Framework)

Method A: rootAVD (Recommended - Automated)

# Clone rootAVD tool (migrated to GitLab)
git clone https://gitlab.com/newbit/rootAVD.git
cd rootAVD

# Download latest Magisk APK
# From: https://github.com/topjohnwu/Magisk/releases
# Rename to Magisk.zip and place in rootAVD directory
curl -L -o Magisk.zip https://github.com/topjohnwu/Magisk/releases/download/v28.1/Magisk-v28.1.apk

# List all AVD ramdisk images
./rootAVD.sh ListAllAVDs

# Root the specific system image
./rootAVD.sh system-images/android-36.1/google_apis/arm64-v8a/ramdisk.img

# Restart emulator (cold boot)
adb reboot

Method B: Manual Magisk Patching

# Start emulator with writable system
emulator -avd Pixel_9_Pro_API_36 -writable-system &

# Get root access
adb root

# Install Magisk APK
adb install Magisk-v28.1.apk

# Push ramdisk to device
adb push $ANDROID_HOME/system-images/android-36.1/google_apis/arm64-v8a/ramdisk.img /sdcard/Download/

# Open Magisk app on emulator → Install → Select and Patch File
# Choose /sdcard/Download/ramdisk.img
# Patched file saved to /sdcard/Download/magisk_patched_*.img

# Pull patched ramdisk
adb pull /sdcard/Download/magisk_patched_*.img ./

# Replace original ramdisk
cp magisk_patched_*.img $ANDROID_HOME/system-images/android-36.1/google_apis/arm64-v8a/ramdisk.img

# Restart emulator
adb reboot

Verify Root Access

# Check root in ADB
adb root
adb shell su -c "id"
# Output: uid=0(root) gid=0(root)

# Open Magisk app on emulator - should show:
# - Magisk: Installed (28.1)
# - Ramdisk: Yes

Configure Magisk

# Enable Zygisk (via Magisk app Settings)
# Settings → Zygisk → Enable → Reboot

# Hide Magisk app (anti-detection)
# Settings → Hide Magisk App → Randomize package name

# Configure MagiskHide (if targeting specific apps)
adb shell su -c "magiskhide enable"
adb shell su -c "magiskhide add <package.name>"

Install Magisk Modules

LSPosed (Xposed Framework)

# Download LSPosed Zygisk release
# https://github.com/LSPosed/LSPosed/releases
curl -L -o LSPosed.zip https://github.com/LSPosed/LSPosed/releases/download/v1.9.2/LSPosed-v1.9.2-7024-zygisk-release.zip

# Install via Magisk app
adb push LSPosed.zip /sdcard/Download/
# Magisk → Modules → Install from storage → Select LSPosed.zip
# Reboot emulator
adb reboot

SSL Certificate Unpinning Modules

JustTrustMe:

# Download from Xposed repo or GitHub
adb push JustTrustMe.apk /sdcard/Download/
adb install /sdcard/Download/JustTrustMe.apk

# Enable in LSPosed:
# LSPosed → Modules → JustTrustMe → Enable → Select target apps

TrustMeAlready:

# Magisk module for system-wide certificate trust
adb push TrustMeAlready.zip /sdcard/Download/
# Magisk → Modules → Install → TrustMeAlready.zip → Reboot

MagiskTrustUserCerts

# Auto-trust user certificates as system certs
# Download: https://github.com/NVISOsecurity/MagiskTrustUserCerts
adb push MagiskTrustUserCerts.zip /sdcard/Download/
# Magisk → Modules → Install → MagiskTrustUserCerts.zip → Reboot

SSL Certificate Installation

Install BurpSuite/Charles Certificate

# Export certificate from Burp/Charles as DER format: cacert.der

# Convert to PEM and get hash
openssl x509 -inform DER -in cacert.der -out cacert.pem
HASH=$(openssl x509 -inform PEM -subject_hash_old -in cacert.pem | head -1)

# Rename certificate
cp cacert.pem ${HASH}.0

# Push to emulator
adb root
adb remount
adb push ${HASH}.0 /system/etc/security/cacerts/
adb shell chmod 644 /system/etc/security/cacerts/${HASH}.0
adb reboot

Verify Certificate Installation

# Check installed certificates
adb shell ls -la /system/etc/security/cacerts/ | grep $(openssl x509 -inform PEM -subject_hash_old -in cacert.pem | head -1)

# Or via Settings on emulator:
# Settings → Security → Encryption & credentials → Trusted credentials → System

Traffic Interception Setup

Configure Proxy

# Set WiFi proxy on emulator
# Settings → Network & Internet → WiFi → AndroidWifi → Proxy → Manual
# Hostname: 10.0.2.2 (host loopback for emulator)
# Port: 8080 (BurpSuite default)

# Or via ADB:
adb shell settings put global http_proxy 10.0.2.2:8080

# Remove proxy:
adb shell settings put global http_proxy :0

BurpSuite Configuration

# Proxy → Options → Proxy Listeners
# Add: 0.0.0.0:8080
# Enable "Support invisible proxying"

# Ensure firewall allows incoming on 8080

Test Traffic Capture

# Install test app
adb install target_app.apk

# Launch app and verify traffic in Burp
# If no traffic appears:
# 1. Check proxy settings
# 2. Verify certificate installed
# 3. Enable JustTrustMe module for app
# 4. Check app doesn't use proxy detection

Install Frida for Dynamic Analysis

Install Frida Server

# Download Frida server for Android
# https://github.com/frida/frida/releases
# Choose: frida-server-*-android-arm64

curl -L -o frida-server https://github.com/frida/frida/releases/download/16.5.9/frida-server-16.5.9-android-arm64.xz
unxz frida-server-16.5.9-android-arm64.xz

# Push to device
adb push frida-server /data/local/tmp/
adb shell chmod 755 /data/local/tmp/frida-server

# Run Frida server
adb shell "/data/local/tmp/frida-server &"

Install Frida Tools (Host)

# Install via pip
pip3 install frida-tools

# Verify connection
frida-ps -U
# Should list running processes on emulator

Basic Frida Usage

# example_frida_hook.py
import frida
import sys

def on_message(message, data):
    print(f"[*] {message}")

# Attach to app
device = frida.get_usb_device()
session = device.attach("com.target.app")

# Hook script
script_code = """
Java.perform(function() {
    var MainActivity = Java.use('com.target.app.MainActivity');
    MainActivity.secretMethod.implementation = function() {
        console.log('[*] secretMethod called');
        return this.secretMethod();
    };
});
"""

script = session.create_script(script_code)
script.on('message', on_message)
script.load()
sys.stdin.read()

# Run Frida script
python3 example_frida_hook.py

Common Commands Reference

ADB Essentials

# List devices
adb devices

# Install APK
adb install app.apk
adb install -r app.apk  # reinstall

# Uninstall app
adb uninstall com.package.name

# List installed packages
adb shell pm list packages
adb shell pm list packages -3  # third-party only

# Pull APK from device
adb shell pm path com.package.name
adb pull /data/app/~~hash/com.package.name-hash/base.apk

# Get app data directory
adb shell run-as com.package.name
# (only works for debuggable apps)

# Logcat (filter by app)
adb logcat | grep "com.package.name"
adb logcat -c  # clear log

# Screen capture
adb exec-out screencap -p > screenshot.png

# Screen record
adb shell screenrecord /sdcard/demo.mp4
adb pull /sdcard/demo.mp4

File System Access

# Mount system as writable
adb root
adb remount

# Push/pull files
adb push local_file /sdcard/
adb pull /sdcard/remote_file ./

# Browse file system
adb shell
cd /data/data/com.package.name
ls -la

Process and App Management

# Start activity
adb shell am start -n com.package.name/.MainActivity

# Stop app
adb shell am force-stop com.package.name

# Clear app data
adb shell pm clear com.package.name

# Get running processes
adb shell ps | grep package.name

Troubleshooting

Emulator Won't Boot After Magisk

# Restore from snapshot (if created)
# Android Studio → Device Manager → AVD → Show on Disk → snapshots/

# Or recreate ramdisk:
cd $ANDROID_HOME/system-images/android-36.1/google_apis/arm64-v8a/
# Delete ramdisk.img and re-run Android Studio setup to redownload

ADB Not Detecting Emulator

# Kill and restart ADB server
adb kill-server
adb start-server

# Check emulator is in list
adb devices

# If still not showing:
# - Restart emulator
# - Check $ANDROID_HOME/platform-tools is in PATH

SSL Pinning Still Active

# Ensure MagiskTrustUserCerts is installed
# Verify JustTrustMe is enabled for specific app in LSPosed
# Try alternative modules:
# - SSLUnpinning
# - TrustMeAlready
# - Use Frida script for runtime bypass:

# frida_ssl_bypass.js
Java.perform(function() {
    var CertificatePinner = Java.use('okhttp3.CertificatePinner');
    CertificatePinner.check.overload('java.lang.String', 'java.util.List').implementation = function() {
        console.log('[*] SSL Pinning bypassed');
    };
});

# Run: frida -U -f com.target.app -l frida_ssl_bypass.js

Magisk Modules Not Working

# Check Zygisk is enabled
adb shell su -c "magisk --denylist status"

# Ensure app is not in denylist
adb shell su -c "magisk --denylist rm com.package.name"

# Reinstall module
# Magisk → Modules → Remove → Reinstall → Reboot

App Detects Emulator/Root

# Hide Magisk package name (Settings → Hide Magisk App)

# Use MagiskHide (deprecated but sometimes works)
adb shell su -c "magiskhide enable"
adb shell su -c "magiskhide add com.package.name"

# Install Shamiko module (Zygisk-based hiding)
# Download: https://github.com/LSPosed/LSPosed.github.io/releases

# Modify build.prop to appear as physical device
adb shell su -c "mount -o rw,remount /system"
adb shell su -c "sed -i 's/ro.build.fingerprint=.*/ro.build.fingerprint=google\/redfin\/redfin:13\/TP1A.220624.021\/8877034:user\/release-keys/' /system/build.prop"

Traffic Not Appearing in Proxy

# Verify proxy settings
adb shell settings get global http_proxy
# Output: 10.0.2.2:8080

# Check certificate hash
adb shell ls /system/etc/security/cacerts/ | grep $(openssl x509 -inform PEM -subject_hash_old -in cacert.pem | head -1)

# Ensure BurpSuite listening on all interfaces
# Proxy → Options → Edit → Bind to address: All interfaces

# Test with curl
adb shell curl -x http://10.0.2.2:8080 https://www.google.com

Advanced Patterns

Automated APK Analysis Script

#!/bin/bash
# analyze_apk.sh

APK=$1
PACKAGE=$(aapt dump badging "$APK" | grep package | awk '{print $2}' | sed "s/name='\(.*\)'/\1/")

echo "[*] Installing $APK..."
adb install "$APK"

echo "[*] Starting Frida..."
frida -U -f "$PACKAGE" --no-pause -l ssl_bypass.js

echo "[*] Proxy configured. Monitor Burp for traffic."
adb shell settings put global http_proxy 10.0.2.2:8080

echo "[*] Press Enter to stop and cleanup..."
read

adb uninstall "$PACKAGE"
adb shell settings put global http_proxy :0

Certificate Rotation Script

#!/bin/bash
# update_cert.sh

CERT_DER=$1

openssl x509 -inform DER -in "$CERT_DER" -out /tmp/cacert.pem
HASH=$(openssl x509 -inform PEM -subject_hash_old -in /tmp/cacert.pem | head -1)

adb root
adb remount
adb shell rm -f /system/etc/security/cacerts/${HASH}.0
adb push /tmp/cacert.pem /system/etc/security/cacerts/${HASH}.0
adb shell chmod 644 /system/etc/security/cacerts/${HASH}.0
adb reboot

echo "[*] Certificate updated: ${HASH}.0"

Environment Variables

# All tools should use these environment references:
export ANDROID_HOME=$HOME/Library/Android/sdk  # or appropriate path
export BURP_PROXY="10.0.2.2:8080"
export FRIDA_SERVER_PORT=27042
export ADB_PORT=5037

Security Considerations

• This environment is for legal penetration testing only
• Always obtain proper authorization before testing applications
• Do not use these techniques on apps without permission
• Some techniques may violate app terms of service
• Keep tools updated to avoid detection by modern anti-root/emulator checks

Further Resources

• Magisk Documentation: https://topjohnwu.github.io/Magisk/
• LSPosed Wiki: https://github.com/LSPosed/LSPosed/wiki
• Frida Handbook: https://frida.re/docs/home/
• Android Security Testing Guide: https://mobile-security.gitbook.io/mobile-security-testing-guide/