Android emulator AVD - /system/bin/sh: sudo: inaccessible or not found

[tibonvill]

`aeroot --verbose daemon`

AERoot (Android Emulator ROOTing system) v. 0.3.9
[d] Kernel configuration 5.4.61-android11-0-00791-gbad091cc4bf3-ab6833933 i686 loaded
[d] Retrieving kernel base address from memory
[+] Kernel base address found at 0xffffffffba800000
[d] Retrieving tasklist from memory
[+] Process [2103] found at 0xffff90721c143b00
[+] Overwriting process [2103] credentials
[+] Set SELinux enforce (0xffffffffbc918b19) to 0
[+] Exiting

---

it does seems like I'm root, but I'm unable to run su -c / sudo
Frida server doesn't work well

$ frida -U -f /bin/ls
     ____
    / _  |   Frida 16.2.1 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to Android Emulator 5554 (id=emulator-5554)
Failed to attach: unable to access process with pid 15285 due to system restrictions; try `sudo sysctl kernel.yama.ptrace_scope=0`, or run Frida as root

does it depends on the architecture of the AVD?

[2Dai]

It seems you might have a slight misunderstanding about how the tool works. Aeroot alters the metadata of the kernel task structures to grant root privileges to a process specified by the user.

When you use the aeroot --verbose daemon commands, the tool grants root privileges to the ADB daemon. This means that shells created with adb shell will automatically have root rights.

$ adb shell 'id'
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0

You can then start the Frida server directly with this shell so that the Frida server runs as root as well.

Another option is to start the Frida server with a non-privileged user and use Aeroot to grant root privileges to the Frida server.

1. Start the Frida server as a normal user:

$ adb shell
generic_x86_64_arm64:/ $ ./data/local/tmp/frida-server-16.4.5-android-x86_64 &
[1] 1421
generic_x86_64_arm64:/ $ Unable to load SELinux policy from the kernel: Failed to open file '/sys/fs/selinux/policy': Permission denied
generic_x86_64_arm64:/ $ ps -ef | grep frida
shell          1421    585 0 13:41:26 pts/0 00:00:00 frida-server-16.4.5-android-x86_64
shell          1430    585 0 13:41:44 pts/0 00:00:00 grep frida

2. Grant root privileges to the Frida server by using the PID option:

$ aeroot pid 1421
$ adb shell
generic_x86_64_arm64:/ $ ps -ef | grep frida
root           1421    585 0 13:41:26 136:0 00:00:00 frida-server-16.4.5-android-x86_64
shell          1438    585 0 13:42:11 pts/0 00:00:00 grep frida

Finally, by default you don't have the su and sudo binaries in the Google API Playstore emulator images.