> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-9/android/mobile-android-dynamic-analysis.md).

# Dynamic Analysis

## Frida Root Detection Bypass

To bypass Android application root detection using Frida, you can leverage pre-written scripts available on the Frida codeshare. This method injects the script into the running process, allowing it to hook into common root detection libraries (like RootBeer) and modify their return values, tricking the app into thinking the device isn't rooted.

Various scripts are available on the codeshare for bypassing root detection. One common approach utilizes scripts specifically targeting libraries like RootBeer.

Execute the following command, replacing `com.BugBazaar` with the target package name, to use a specific RootBeer bypass script:

```bash
frida -U --codeshare ub3rsick/rootbeer-root-detection-bypass -f com.BugBazaar
```

Alternatively, other codeshare scripts exist for similar purposes. For example, you might use:

```bash
frida --codeshare Zero3141/rootbeer-root-detectio...
```

Or a more unified bypass script that might target both root and debugger detection:

```bash
frida --codeshare sdcampbell/unified-an...
```

These commands attach Frida to a USB-connected device (`-U` is optional if targeting a remote device via network), download and inject the specified codeshare script (`--codeshare`), and spawn the target application (`-f`) with the script already loaded. Ensure the Frida server is running on the target device.