How to get root access on Android emulator?

Question

If you have a virtual device with root access, this should do the job:

$ > adb shell
generic_x86:/ $
generic_x86:/ $ exit
$ > adb root
restarting adbd as root
$ > adb shell
generic_x86:/ #

If you don't, you might be interested in this answer to a different question, which explains how to create an virtual device with root access, with Google APIs (aka Google Play services), but without the Google Play app.

If you really need the Google Play app, you might be interested in other answers which instruct how to root an Android virtual device.

How to root android emulator (tested on Android 7.1.1/ Nougat)

Requirements:

• SuperSU app (chainfire) latest version 2.82

• Recovery flashable.zip (contains su binary) (Here is alternative backup link provided by XDA user Ibuprophen for flashable zips if the main link is not working: Flashable zip releases)

Instructions

1. Install the SuperSu.apk

• Install the SuperSu app firstly, just do drag and drop (if running latest emulator version or sideload through adb i.e adb -e install supersu.apk)

• After installing it, when you run it shows a screen as shown below indicating “There is no SU binary installed..”. This error just confirms the device is not yet rooted.

---

2. Make emulator’ system partition writable

• As it suggests, we need to give the emulator permission to write system files.

• Type the following code to accomplish this: emulator -avd {emulator_name} -writable-system

If you have more than one AVD, you can get a list of avds by using the command: emulator -list-avds

Note: Navigate to the tools folder where Android SDK is installed and open command prompt there by pressing shift and right clicking.

---

3. Pushing su binary in system directory

• Extract the Recovery flashable.zip (containing the su binaries of different architectures)

Important! Only use the su binary that matches your avd architecture e.g x86, arm etc.., and note the path where you extracted these binaries.

• Make sure you are running adb as root and also you need to remount. Just enter these codes

adb root

adb remount

Now its time to push the su binary:

This is the code I successfully used: adb -e push C:\Users\User1\Desktop\rootemu\x86\su.pie /system/bin/su

(nevermind about my specific location of su binary, any location is okay as long there is no white space)

note: To figure out bin or xbin do in console before: > adb shell, > ls /system/xbin/su

If this fails try this pushing to this directory instead /system/xbin/su. Also for emulators running android 5.1 and below use the su and not su.pie

---

4. Change permissions of the su binary

• Next let’s do a bit of modification of the permissions of su binary. We have to do this in emulator device through adb:

adb -e shell
su root
cd /system/bin
chmod 06755 su

Important!! Take note of su binary path (mine is /system/bin)

---

5. Setting the install directive on su binary and set a daemon

Type the codes:

su --install

and for setting up daemon:

su --daemon&

Important!! Take note of spacing

---

6. Setting SELinux to Permissive(i.e turning off SE Linux)

• Finally turn off selinux through this code:

setenforce 0

---

Open SuperSU app and it may ask to update binaries, you can use Normal method.

Note: If you're experiencing bootloops, rather don't update the binaries, just use it as it is.

---

That’s pretty much it!!

Open any application requiring SU permissions just to double check and indeed SuperSU ask if you wish to grant it su permissions.

To have the root persist update su binary (using Normal method), then copy system.img from temp directory (Users\AppData\Local\Temp\Android Emulator the file is usually randomly named e.g 1359g.tmp with a large size) and replace default system.img.

Update:

I have noted is is easier to obtain a temporary system image in Linux, than Windows. You can try using snapshot image.

##Update 4 August 2018

With the emergence of emulator 27.3.x it now makes preserving root much easier through snapshot feature (if copying the system.img method isn't working):

Ideally it is more like hibernarig the virtual device with config intact, hence everything is preserved.

Snapshots

You can now save multiple AVD snapshots for a given device configuration and choose which of the saved snapshots to load when you start the emulator. Starting a virtual device by loading a snapshot is much like waking a physical from a sleep state, as opposed to booting it from a powered-off state.

This implies the only requirement to start the emulator is adding the -writable-system parameter to the normal emulator -avd [avdname] command to start the emulator. (Running the emulator just with emulator -avd [avdname] doesn't launch the rooted version/copy or may lead to some error)

^{Tested on API level 22}

Also for bootloop issues see the other post: Android Emulator: How to avoid boot loop after rooting? and updates thereof.

Remarks

Most content in reference was for older android versions and hence the reason for different commands and paths which I modified.

Acknowledgements;

• Irvin H: Rooting the android emulator -on Android Studio 2.3((Android 4.4)

• Android AVD root access fail.

Here is the list of commands you have to run while the emulator is running, I test this solution for an avd on Android 2.2 :

adb shell mount -o rw,remount -t yaffs2 /dev/block/mtdblock03 /system  
adb push su /system/xbin/su  
adb shell chmod 06755 /system  
adb shell chmod 06755 /system/xbin/su

It assumes that the su binary is located in the working directory. You can find su and superuser here : http://forum.xda-developers.com/showthread.php?t=682828. You need to run these commands each time you launch the emulator. You can write a script that launch the emulator and root it.

For AVD with 5.1.1 and 6.0 I used next script in windows:

set adb=adb -s emulator-5558
set arch=x64
set pie=
adb start-server
%adb% root
%adb% remount
rem %adb% shell mount -o remount,rw /system
%adb% shell setenforce 0
%adb% install common/Superuser.apk
%adb% push %arch%/su%pie% /system/bin/su
%adb% shell chmod 0755 /system/bin/su
%adb% push %arch%/su%pie% /system/xbin/su
%adb% shell chmod 0755 /system/xbin/su
%adb% shell su --install
%adb% shell "su --daemon&"
rem %adb% shell mount -o remount,ro /system

exit /b

Need UPDATE.zip from SuperSU. Unpacked them to any folder. Create bat file with content above. Do not forget specify necessary architecture and device: set adb=adb -s emulator-5558 and set arch=x64. If you run Android above or equal 5.0, change set pie= to set pie=.pie. Run it. You get temporary root for current run.

If you got error on remount system partition then you need start AVD from command line. See below first step for Android 7.

If you want make it persistent - update binary in SuperSU and store system.img from temp folder as replace of default system.img.

How to convert the resulting temporary root on a permanent

First - it goes to SuperSu. It offers a binary upgrade. Update in the normal way. Reboot reject.

Second - only relevant for emulators. The same AVD. The bottom line is that changes in the system image will not be saved. You need to keep them for themselves.

There are already instructions vary for different emulators.

For AVD you can try to find a temporary file system.img, save it somewhere and use when you start the emulator.

In Windows it is located in the %LOCALAPPDATA%\Temp\AndroidEmulator and has a name something like TMP4980.tmp.

You copy it to a folder avd device (%HOMEPATH%\.android\avd\%AVD_NAME%.avd\), and renamed to the system.img.

Now it will be used at the start, instead of the usual. True if the image in the SDK is updated, it will have the old one.

In this case, you will need to remove this system.img, and repeat the operation on its creation.

More detailed manual in Russian: http://4pda.ru/forum/index.php?showtopic=318487&view=findpost&p=45421931

---

For android 7 you need run additional steps: 1. Need run emulator manually. Go to sdk folder sdk\tools\lib64\qt\lib. Run from this folder emulator with options -writable-system -selinux disabled Like this:

F:\android\sdk\tools\lib64\qt\lib>F:\android\sdk\tools\emulator.exe -avd 7.0_x86 -verbose -writable-system -selinux disabled

2. You need restart adbd from root:

   adb -s emulator-5554 root

And remount system:

adb -s emulator-5554 remount

It can be doned only once per run emulator. And any another remount can break write mode. Because of this you not need run of any other commands with remount, like mount -o remount,rw /system.

Another steps stay same - upload binary, run binary as daemon and so on.

Picture from AVD Android 7 x86 with root:

---

If you see error about PIE on execute su binary - then you upload to emulator wrong binary. You must upload binary named su.pie inside archive, but on emulator it must be named as su, not su.pie.

I believe that the easiest way is to create an alias for the command sh, e.g.

adb shell
mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
cd /system/bin
cat sh > su && chmod 4775 su

Tested on Android Emulator 3.0 and higher.

Here my pack with all you need. Or you can use this script:

echo on
set device=emulator-5554
set avd_name=
set adb=d:\Poprygun\DevTools\Android\Android-sdk\platform-tools\adb -s %device%
set emulator=d:\Poprygun\DevTools\Android\Android-sdk\emulator\emulator
set arch=x86
set pie=

echo Close all ANDROID emulators and press any key
pause
start %emulator% -avd Nexus_One_API_25 -verbose -writable-system
echo Wait until ANDROID emulator loading and press any key
pause

%adb% start-server
%adb% root
%adb% remount
%adb% shell setenforce 0
%adb% install D:\SuperSU\SuperSU.apk
%adb% push D:\SuperSU\su\%arch%\su.pie /system/bin/su
%adb% shell chmod 0755 /system/bin/su
%adb% push D:\SuperSU\su\%arch%\su.pie /system/xbin/su
%adb% shell chmod 0755 /system/xbin/su
%adb% shell su --install
%adb% shell "su --daemon&"
pause
exit /b