Port MASTG-TEST-0045 (Root Detection) from v1 to v2 by Copilot · Pull Request #3604 · OWASP/mastg

Copilot · 2025-12-21T09:38:46Z

This PR ports MASTG-TEST-0045 (Testing Root Detection) from v1 to v2, splitting it into separate static and dynamic tests with comprehensive supporting content including techniques, demos, best practices, apps, tools, and Semgrep rules.

Structure

Tests

MASTG-TEST-0324: Static analysis for root detection code patterns
MASTG-TEST-0325: Dynamic analysis using runtime bypass to identify detection mechanisms
MASTG-TEST-0045: Updated to mark as deprecated

Techniques

MASTG-TECH-0042: Modified/updated existing technique
MASTG-TECH-0144: Documents bypass methods using objection and Frida for root detection evasion

Best Practices

MASTG-BEST-0029: Implementation guidance covering file-based, package, process, and system property checks
MASTG-BEST-0030: Additional best practice for root detection

Demos

MASTG-DEMO-0087: Static demo with working Kotlin/Java code samples, including AndroidManifest.xml, source code, reversed Java, and Semgrep output
MASTG-DEMO-0088: Dynamic demo with Frida hooks configuration (hooks.json) and output demonstrating root detection bypass

Apps

MASTG-APP-0032: Sample app for root detection testing
MASTG-APP-0033: Additional sample app for root detection testing

Tools

MASTG-TOOL-0146: Tool documentation for root detection analysis
MASTG-TOOL-0147: Additional tool documentation

Knowledge

MASTG-KNOW-0027: Updated knowledge article linked to tests and best practices

Additional Changes

Added new Semgrep rules in rules/mastg-android-root-detection.yaml
Marked original MASTG-TEST-0045 as deprecated

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

mas.owasp.org
- Triggering command: /usr/bin/curl curl -s REDACTED git conf�� unset --global /snap/bin/git user.email (dns block)
semgrep.dev
- Triggering command: /home/REDACTED/.local/bin/pysemgrep osemgrep --config ../../../../rules/mastg-android-root-detection.yaml ./MastgTest_reversed.java --text k/mastg/mastg/best-practices/android/MASVS-RESILIENCE/ -TEST-0036.md nfig/composer/vendor/bin/grep (dns block)
- Triggering command: /home/REDACTED/.local/bin/pysemgrep osemgrep --config ../../../../rules/mastg-android-root-detection.yaml ./MastgTest_reversed.java --text --noprofile STG-TEST-0020.md p/bin/grep (dns block)
- Triggering command: /home/REDACTED/.local/bin/pysemgrep osemgrep --config test_rule.yaml ./MastgTest_reversed.java --text --noprofile STG-TEST-0021.md./techniques/android/MASTG-TECH-0041.md x-gnu.so (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

This section details on the original issue you should resolve

<issue_title>MASTG v1->v2 MASTG-TEST-0045: Testing Root Detection (android)</issue_title>
<issue_description>
Create a new MASTG v2 test covering for":

Title: Testing Root Detection

ID: MASTG-TEST-0045

Link: https://mas.owasp.org/MASTG/tests/android/MASVS-RESILIENCE/MASTG-TEST-0045/

Platform: android

MASVS v1: ['MSTG-RESILIENCE-1']

MASVS v2: ['MASVS-RESILIENCE-1']

Follow the guidelines
</issue_description>

<agent_instructions>- split into one static and dynamic v2 test

create one MASTG-TECH for bypassing root detection (it can be used in the dynamic test and demo to "bypass in order to determine if the detection is there", e.g. using objection)

create one demo for each v2 test

add a best practice and link it to the test

add knowledge: [MASTG-KNOW-0027] to the test and best practice
</agent_instructions>

Comments on the Issue (you are @copilot in this section)
@cpholguera As a reference, see https://github.com//pull/3073/files

Fixes MASTG v1->v2 MASTG-TEST-0045: Testing Root Detection (android) #3021

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

- Add MASTG-TECH-0142: Bypassing Root Detection technique - Add MASTG-TEST-0289: Static test for root detection in code - Add MASTG-TEST-0290: Dynamic test for runtime root detection - Add MASTG-BEST-0028: Best practice for implementing root detection - Add MASTG-DEMO-0040: Static demo with semgrep rules - Add MASTG-DEMO-0041: Dynamic demo with Frida bypass script - Add semgrep rules for detecting root detection patterns - Deprecate old MASTG-TEST-0045 with references to new tests Co-authored-by: cpholguera <29175115+cpholguera@users.noreply.github.com>

Co-authored-by: cpholguera <29175115+cpholguera@users.noreply.github.com>

serek8

Added a couple of comments. Not sure what is the current policy about the Test and Demo titles. @cpholguera are they good here?

Should we mention that a user can install e.g. KernelSU to verify if the app can resist more advanced rooting tools. We keep saying about more advanced bypasses but don't really describe what they are and how to test the app against them.

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0540/MASTG-DEMO-0540.md

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0540/MastgTest.kt

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0502.md

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0501.md

best-practices/MASTG-BEST-0028.md

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0501.md

best-practices/MASTG-BEST-0028.md

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0502.md

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0541/MASTG-DEMO-0541.md

…pilot/add-testing-root-detection

Co-authored-by: Jan Seredynski <janseredynski@gmail.com>

…y and completeness

…led explanations and updated techniques

Copilot

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 11 comments.

knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0027.md

best-practices/MASTG-BEST-0528.md

techniques/android/MASTG-TECH-0542.md

rules/mastg-android-root-detection.yaml

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0088/hooks.json

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0501.md

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0502.md

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0540/MASTG-DEMO-0540.md

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0541/MASTG-DEMO-0541.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…ion checks

…ining Runtime.exec patterns

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…use BUILD.TAGS

…ions

…ation documentation

… methods

Copilot

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 13 comments.

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0087/MASTG-DEMO-0087.md

rules/mastg-android-root-detection.yaml

knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0027.md

best-practices/MASTG-BEST-0030.md

best-practices/MASTG-BEST-0029.md

rules/mastg-android-root-detection.yaml

tests-beta/android/MASVS-RESILIENCE/MASTG-TEST-0324.md

best-practices/MASTG-BEST-0030.md

knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0027.md

techniques/android/MASTG-TECH-0042.md

best-practices/MASTG-BEST-0029.md

serek8

added a couple of suggestions to make sure we don't miss knowledge from #3136
added a check for dev-keys to make sure we cover more root setups including AndroidStudio emulators

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0087/MastgTest.kt

…te script permissions

…mentation

Initial plan

3abccd8

Copilot AI assigned Copilot and cpholguera Dec 21, 2025

Copilot started work on behalf of cpholguera December 21, 2025 09:39 View session

Copilot AI and others added 2 commits December 21, 2025 09:58

Remove temporary test file from demo

86f3b40

Co-authored-by: cpholguera <29175115+cpholguera@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Create MASTG v2 tests for root detection~~ Port MASTG-TEST-0045 (Root Detection) from v1 to v2 Dec 21, 2025

Copilot AI requested a review from cpholguera December 21, 2025 10:05

Copilot finished work on behalf of cpholguera December 21, 2025 10:05

serek8 suggested changes Jan 30, 2026

View reviewed changes

serek8 reviewed Jan 30, 2026

View reviewed changes

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0541/MASTG-DEMO-0541.md Outdated Show resolved Hide resolved

cpholguera and others added 17 commits February 4, 2026 23:02

fix IDs

67ce445

fix IDs

60f8765

Merge branch 'master' of https://github.com/OWASP/owasp-mastg into co…

7547570

…pilot/add-testing-root-detection

Apply suggestions from code review

9081e39

Co-authored-by: Jan Seredynski <janseredynski@gmail.com>

updated reverse eng file and run

a7db6cf

update rule and output

552772c

update demo

357785f

update demo

2954fab

update demo to use frooky

362bfbb

refine root detection demo output details

22f8375

fix lint errors

873bcfd

refactor root detection documentation for clarity and conciseness

bac5c8b

refine root detection documentation and testing guidelines for clarit…

e6ba2e3

…y and completeness

Update titles and techniques

f3df27a

fix incorrect tool ref

1b6550d

refine alternative approaches for bypassing root detection with detai…

1613ffb

…led explanations and updated techniques

refactor root detection best practices for clarity and conciseness

99ac53f

cpholguera requested a review from Copilot February 7, 2026 10:20

Copilot started reviewing on behalf of cpholguera February 7, 2026 10:21 View session

Copilot AI reviewed Feb 8, 2026

View reviewed changes

cpholguera and others added 9 commits February 8, 2026 12:55

Apply suggestions from code review

f7bf9f5

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Fix potential recursion bug in Frida script for bypassing root detect…

8ca6180

…ion checks

Enhance root detection rules by adding system property checks and ref…

3c8b263

…ining Runtime.exec patterns

Update MASTG-DEMO-0541 evaluation

cf9d9cb

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Refine custom Android build detection by updating BUILD tag check to …

b0ac255

…use BUILD.TAGS

Add sample applications for RootBeer and Android RASP libraries

43b4e4d

Add RootBeer and Android RASP tool documentation with sample applicat…

556139a

…ions

Remove redundant details from RootBeer and Android RASP sample applic…

e4c556d

…ation documentation

Refactor Frida script for dynamically listing loaded Java classes and…

7b134d1

… methods

cpholguera mentioned this pull request Feb 9, 2026

Port MASTG-TEST-0045: Testing Root Detection (android) #3136

Closed

fix IDs

0cbb539

cpholguera marked this pull request as ready for review February 9, 2026 09:33

cpholguera requested a review from Copilot February 9, 2026 09:34

Copilot started reviewing on behalf of cpholguera February 9, 2026 09:35 View session

Copilot AI reviewed Feb 9, 2026

View reviewed changes

serek8 approved these changes Feb 9, 2026

View reviewed changes

Diolor reviewed Feb 9, 2026

View reviewed changes

best-practices/MASTG-BEST-0029.md Show resolved Hide resolved

serek8 reviewed Feb 9, 2026

View reviewed changes

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0087/MastgTest.kt Show resolved Hide resolved

demos/android/MASVS-RESILIENCE/MASTG-DEMO-0087/MastgTest.kt Show resolved Hide resolved

cpholguera added 5 commits February 9, 2026 15:27

Enhance root detection rules with regex for file path checks and upda…

3f6d702

…te script permissions

Update link for checking custom Android builds in root detection docu…

5b2a8b6

…mentation

fix typo

5cea833

Add which su case

d24369b

minor fixes from code review

d61f9e6

cpholguera mentioned this pull request Feb 9, 2026

Consider dev-keys for MASTG-DEMO-0087 #3695

Open

serek8 approved these changes Feb 9, 2026

View reviewed changes

Copilot started work on behalf of cpholguera February 9, 2026 17:18 View session

Copilot stopped work on behalf of cpholguera due to an error February 9, 2026 17:21
Copilot encountered an unknown Git error. If the problem persists, please contact GitHub Support. To retry, leave a comment on this pull request asking Copilot to try again.

cpholguera merged commit ad2a6e8 into master Feb 9, 2026
9 of 11 checks passed

cpholguera deleted the copilot/add-testing-root-detection branch February 9, 2026 17:42

Uh oh!

Conversation

Copilot AI commented Dec 21, 2025 • edited by cpholguera Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Structure

Tests

Techniques

Best Practices

Demos

Apps

Tools

Knowledge

Additional Changes

I tried to connect to the following addresses, but was blocked by firewall rules:

Comments on the Issue (you are @copilot in this section)

Uh oh!

serek8 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

serek8 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Dec 21, 2025 •

edited by cpholguera

Loading