# How to Detect Root using Kotlin

As a developer facing the challenge of root detection, you’ve landed exactly where you need to be—we’ll break down your options and help you make the right choice. Written by experts who’ve built and battled this themselves 😎.

<figure><img src="https://1548930415-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNjTFXsqCLQ3RU2oA2uHC%2Fuploads%2FQp8ZmvXcd1fU6Irwevjg%2Fshizuku.png?alt=media&#x26;token=357e8bd5-272b-4609-abba-c42d99c1c37b" alt=""><figcaption></figcaption></figure>

### What is rooting?

**Rooting** is the process of gaining privileged (root or superuser) access to an Android device. Rooting bypasses the application sandbox model, allowing users—and attackers—to access and modify system-level files and settings.&#x20;

Think of rooting as “administrator access” on a Linux-based OS (which Android is). Common rooting tools include **Magisk**, **SuperSU**, **Shamiko, KingoRoot** and much more.

And how common is root access? 0.03% of devices are rooted — a **significant number** that could pose security risks

<figure><img src="https://1548930415-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNjTFXsqCLQ3RU2oA2uHC%2Fuploads%2F3hO6WkAYO7n5Ot0gyTY4%2Fimage.png?alt=media&#x26;token=516c64d9-d772-43b3-a094-9ed84238f69d" alt=""><figcaption><p>Number of Rooted Devices (source: Talsec)</p></figcaption></figure>

{% hint style="success" %}
Check out our live global stats at [my.talsec.app](https://my.talsec.app)
{% endhint %}

While rooting can enable customizations (e.g. removing bloatware, customizing ROMs, running system-level scripts), with that power comes a huge attack surface. **It introduces security vulnerabilities**—like the ability to hook and inject the code using tools like **Frida** or **Xposed.**

### How to detect rooted device?

Detecting root on Android is complex and constantly evolving, especially with tools like Magisk. While building your own solution offers control, it’s not recommended due to the **time**, **effort**, and **expertise** required to keep up. Instead, using third-party libraries like [freeRASP](https://docs.talsec.app/freerasp/) or [RootBeer](https://github.com/scottyab/rootbeer) provides a reliable and up-to-date solution maintained by experts.

### DIY Coding Guide

You can implement yourself simple root detection like this:

```kotlin
import android.os.Build
import java.io.File

object RootUtil {

    val isDeviceRooted: Boolean
        get() = checkBuildTags() || checkSuPaths()

    private fun checkBuildTags(): Boolean {
        val buildTags = Build.TAGS
        return buildTags != null && buildTags.contains("test-keys")
    }

    private fun checkSuPaths(): Boolean {
        val paths = arrayOf(
            "/system/app/Superuser.apk",
            "/sbin/su",
            "/system/bin/su",
            "/system/xbin/su",
            "/data/local/xbin/su",
            "/data/local/bin/su",
            "/system/sd/xbin/su",
            "/system/bin/failsafe/su",
            "/data/local/su",
            "/su/bin/su"
        )

        for (path in paths) {
            if (File(path).exists()) {
                return true
            }
        }
        return false
    }
}
```

### Popular Libraries: freeRASP, RootBeer, Play Integrity

Let's compare the most popular options. It's immediately clear why freeRASP is so popular—with a staggering 6,000+ apps using it as of July 2025.

1. **👑 freeRASP (free library by Talsec)**

* Very strong root detector — detects **Magisk 29** and **Shamiko**
* Actively maintained ([changelog](https://docs.talsec.app/freerasp/whats-new-and-changelog))
* Comes with [14 extra detections](https://docs.talsec.app/freerasp/wiki/threat-detection) like app integrity, Frida and hooking, emulators, debugging, screenshots, etc.
* Used by 6000+ apps; #1 Mobile RASP SDK by popularity ([link](https://42matters.com/sdk-analysis/top-security-and-privacy-sdks#talsec))
* Integration guide: <https://docs.talsec.app/freerasp>

```kotlin
// Start detection (asynchronously)
Talsec.start(...)

override fun onRootDetected() {
    Log.w("freeRASP", "Device is rooted!")
    // Take action if needed
}
```

2. **🍺 RootBeer (open-source library by Scott Alexander-Bown)**

* Open-source root detection tool.
* Fully offline checks (no internet dependency).
* Lacks detection of the latest techniques.
* Used by 5000+ apps
* Integration guide: <https://github.com/scottyab/rootbeer>

```kotlin
// Perform detections (blocking)
val rootBeer = RootBeer(...)

if (rootBeer.isRooted) {
    Log.w("RootBeer", "Device is rooted!")
    // Take action if needed
}
```

3. **📡 Play Integrity (library by Google)**

* Offers strong and officially supported integrity checks.
* Requires Google Play Services and backend integration.
* Dependent on internet connectivity.
* Integration guide: <https://developer.android.com/google/play/integrity/setup>

#### Comparison Table

| Capability                      | freeRASP                                | RootBeer     | Play Integrity API                          |
| ------------------------------- | --------------------------------------- | ------------ | ------------------------------------------- |
| **Root Detection Accuracy**     | High                                    | Medium       | ❌ Indirect (via signals)                    |
| **Trusted by**                  | 6000+ apps                              | 5000+ apps   | N/A                                         |
| **Works Offline**               | ✅                                       | ✅            | ❌ (requires Google Play + Backend)          |
| **Detection Response**          | Listener-based                          | Manual check | Backend-dependent, server-based validation  |
| **Covers Magisk/Hidden Root**   | ✅                                       | ❌            | ❌  (Indirect)                               |
| **Easy Integration**            | ✅                                       | ✅            | Moderate (needs server)                     |
| **Additional Threats Detected** | Emulator, Tamper, Debug, Install Source | Root only    | Account                                     |
| **Community & Support**         | Active                                  | Declining    | *Classic Google — no support whatsoever.*   |
| **Integration**                 | In-app SDK                              | In-app SDK   | In-app SDK + Backend-dependent, Google-only |

#### Commercial Alternatives

When evaluating mobile app security and Runtime Application Self-Protection (RASP), developers often compare various Talsec alternatives to find the right fit for their architecture. The "right choice" depends on the specific problem you need to tackle and which vendor offers the best **bang for your buck**.

The market is diverse, offering different philosophical approaches to protection. Talsec prioritizes top-tier root detection and a balanced security SDK portfolio covering the most popular attack vectors. Meanwhile, some vendors specialize primarily in heavy code obfuscation and compiler-based hardening, while others focus on a drag-and-drop (no-code) integration experience for DevOps-oriented teams. There are also solutions dedicated specifically to API security, active cloud hardening, enterprise compliance, or gaming protection. The most prominent providers alongside **Talsec** include **Guardsquare**, **Appdome**, **Promon**, **Build38**, **Approov**, and **AppSealing**.

You can find detailed description about root and jailbreak detection in our glossary and articles:

<table data-view="cards"><thead><tr><th></th><th data-hidden data-card-cover data-type="files"></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Glossary: Root Detection</strong></td><td><a href="https://1548930415-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNjTFXsqCLQ3RU2oA2uHC%2Fuploads%2FHYdex3HHgFJlqSVISvNc%2Fwordcloud%20(1).jpg?alt=media&#x26;token=26bda058-7a11-4d04-90a7-20837f0b01a6">wordcloud (1).jpg</a></td><td></td></tr><tr><td><strong>Glossary: Jailbreak Detection</strong></td><td><a href="https://1548930415-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNjTFXsqCLQ3RU2oA2uHC%2Fuploads%2FHYdex3HHgFJlqSVISvNc%2Fwordcloud%20(1).jpg?alt=media&#x26;token=26bda058-7a11-4d04-90a7-20837f0b01a6">wordcloud (1).jpg</a></td><td></td></tr><tr><td><strong>Simple Root Detection: Implementation and Verification</strong></td><td><a href="https://1548930415-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNjTFXsqCLQ3RU2oA2uHC%2Fuploads%2FAEC5Y6ar1LCWw1ST49rN%2FRoot%20Detection%20Basics.png?alt=media&#x26;token=74c24779-e027-4394-b28d-06f44e180e34">Root Detection Basics.png</a></td><td><a href="simple-root-detection-implementation-and-verification">simple-root-detection-implementation-and-verification</a></td></tr></tbody></table>

{% hint style="success" %}
Handle App Security with a Single Solution! Check Out Talsec's Premium Offer & Plan Comparison!<br>

#### Apps Security Threats Report 2025

<https://www.talsec.app/talsec-global-threat-report-2025>

#### Plans Comparison

<https://www.talsec.app/plans-comparison>

#### &#x20;Premium Products:

* [RASP+](https://app.gitbook.com/s/xFHPMAbn16uoDyOtoiaC/product/rasp) - An advanced security SDK that actively shields your app from reverse engineering, tampering, rooting/jailbreaking, and runtime attacks like hooking or debugging.
* [AppiCrypt](https://docs.talsec.app/premium-products/product/appicrypt) (Android & iOS) & [AppiCrypt for Web](https://app.gitbook.com/s/xFHPMAbn16uoDyOtoiaC/product/appicryptweb) - A backend defense system that verifies the integrity of the calling app and device to block bots, scripts, and unauthorized clients from accessing your API.
* [Malware Detection](https://docs.talsec.app/premium-products/product/malware-detection) - Scans the user's device for known malicious packages, suspicious "clones," and risky permissions to prevent fraud and data theft.
* [Dynamic TLS Pinning](https://docs.talsec.app/premium-products/product/app-hardening#about-dynamic-tls-pinning) - Prevents Man-in-the-Middle (MitM) attacks by validating server certificates that can be updated remotely without needing to publish a new app version.
* [Secret Vault](https://docs.talsec.app/premium-products/product/app-hardening#about-secret-vault) - A secure storage solution that encrypts and obfuscates sensitive data (like API keys or tokens) to prevent them from being extracted during reverse engineering.
  {% endhint %}