Rooted Android Emulator for Application Testing

Setting up an Android Studio emulator (AVD) that is rooted with Magisk and proxied through Burp Suite is the standard workbench for Android application security testing. This page describes the current workflow against Google Play images (API 34/35, Android 14–15), which resist older rooting tricks.

Why the Play Store images are harder

AVDs built on Google APIs images (no Play Store) allow adb root out of the box. Google Play images ship production-style: adb root is refused, SELinux is enforcing, and the system partition is read-only — so rooting requires patching the boot ramdisk with Magisk via rootAVD.¹²

Create the AVD

1. Install Android Studio and put the platform-tools (adb, emulator) on your PATH.³
2. Device Manager → Create Virtual Device:
   • Device: Pixel 8 Pro (or similar)
   • System image: API 35 Google Play (arm64-v8a on Apple Silicon/ARM hosts, x86_64 otherwise)
   • Advanced settings: Boot option → Cold boot (quick-boot snapshots interfere with ramdisk swapping); device frame off (optional)

Root with rootAVD + Magisk

rootAVD automates patching the AVD ramdisk with Magisk.⁴⁵

git clone https://gitlab.com/newbit/rootAVD.git
cd rootAVD
 
# Pre-fetch the latest stable Magisk APK. The Magisk bundled with
# rootAVD lags behind and mishandles Android 14+, and the emulator's
# busybox wget fails on GitHub's TLS — so pull it on the host.
MAGISK_VERSION=$(
  curl -sL https://api.github.com/repos/topjohnwu/Magisk/releases/latest |
  grep tag_name | sed 's/.*": *"//;s/".*//'
)
curl -sL -o Magisk.zip \
  https://github.com/topjohnwu/Magisk/releases/download/$MAGISK_VERSION/Magisk-$MAGISK_VERSION.apk
 
# List images rootAVD can see
./rootAVD.sh ListAllAVDs
 
# Boot the AVD writable, no snapshot (separate terminal)
emulator -avd Pixel_8_Pro_API_35 -no-snapshot-load -writable-system
 
# Patch via the FAKEBOOTIMG flow
./rootAVD.sh system-images/android-35/google_apis_playstore/arm64-v8a/ramdisk.img FAKEBOOTIMG

During the ~60 s FAKEBOOTIMG pause, open Magisk in the emulator and use Install → Select and Patch a File on /sdcard/Download/fakeboot.img. Press Enter in rootAVD when done; the AVD shuts down. Reboot, then:

adb shell
su   # accept the Magisk superuser prompt on the emulator

Proxy traffic through Burp Suite

Apps on Android 7+ ignore user CA certs for TLS by default; the Burp CA must be installed as a system CA.⁶ On Android 14+ the system store lives in an APEX module (com.android.conscrypt), which is mounted read-only — the trick is to bind-mount a writable copy over it.⁷

1. Configure Burp’s proxy listener to bind all interfaces (or the host-only one), default port 8080.
2. From the host:

# Pull Burp's CA and compute its Android system-store filename
CERT_DATA="$(curl -s http://127.0.0.1:8080/cert | openssl x509 -inform DER)"
CERT_NAME="$(echo "$CERT_DATA" | openssl x509 -inform PEM -subject_hash_old | head -1).0"
 
# Writable-overlay script for the conscrypt APEX
cat > setup-burp-ca.sh << EOF
#!/system/bin/sh
setenforce 0
mount -o remount,exec /apex
cp -pr /apex/com.android.conscrypt /apex/com.android.conscrypt.bak
umount -l /apex/com.android.conscrypt
cp -pr /apex/com.android.conscrypt.bak /apex/com.android.conscrypt
cat > /apex/com.android.conscrypt/cacerts/$CERT_NAME << CA_CERT
$CERT_DATA
CA_CERT
chown system:system /apex/com.android.conscrypt/cacerts/$CERT_NAME
chmod 644 /apex/com.android.conscrypt/cacerts/$CERT_NAME
chcon u:object_r:system_file:s0 /apex/com.android.conscrypt/cacerts/$CERT_NAME
killall system_server
EOF
 
adb push setup-burp-ca.sh /sdcard/Download
adb shell "su --command sh /sdcard/Download/setup-burp-ca.sh"

3. After the UI restarts, set the Wi-Fi proxy: Settings → Network & internet → Internet → AndroidWifi → ⚙ → ✏ → Advanced → Proxy → Manual:
   • Hostname: 10.0.2.2 (the emulator’s alias for the host loopback)
   • Port: 8080

The CA install does not survive reboot (APEX mounts are reconstructed), but the script and proxy settings do — re-run adb shell "su --command sh /sdcard/Download/setup-burp-ca.sh" after each boot.

Sources

• rootAVD — root your Android Studio Virtual Device with Magisk (newbit)
• Android Developers — Run apps on the Android Emulator
• Android Developers — Android Debug Bridge (adb)
• g1a55er — Android 14 Still Allows Modification of System Certificates (2023)
• PortSwigger — Configuring an Android device to work with Burp Suite
• Magisk (topjohnwu) — Magic Mask for Android

Related: adb-port-forwarding, burp-suite-firefox, burp-suite-aws-cli-proxy, burp-suite-mobile-apps

Footnotes

1. Android Developers — Run apps on the Android Emulator ↩

2. rootAVD — root your Android Studio Virtual Device with Magisk (newbit) ↩

3. Android Developers — Android Debug Bridge (adb) ↩

4. rootAVD — root your Android Studio Virtual Device with Magisk (newbit) ↩

5. Magisk (topjohnwu) — Magic Mask for Android ↩

6. PortSwigger — Configuring an Android device to work with Burp Suite ↩

7. g1a55er — Android 14 Still Allows Modification of System Certificates (2023) ↩