When purchasing a used smartphone or installing custom firmware, the user is often faced with uncertainty: does the device have superuser rights? The presence root access dramatically changes the system management capabilities, allowing you to remove system garbage, change the processor frequency and block ads at the kernel level. However, with new opportunities comes increased risk: malware can gain complete control of the device, and banking applications often refuse to work on rooted gadgets.
Determining the status of privileges is not always obvious, since some methods of obtaining root access is hidden from the eyes of the average user. In this article, we will look at the most reliable diagnostic methods, from installing specialized utilities to using USB debugging. You will learn to distinguish full access from emulation and understand what traces in the file system indicate the presence of modifications.
Before you begin checking, it is important to realize that methods may vary depending on the version Android and device model. For example, on older versions of the system, the presence of a file su was a sufficient sign, while modern rights managers use more complex implementation mechanisms. We will look at universal approaches that are relevant for most modern smartphones.
Using specialized detector applications
The fastest and most understandable way for the average user is to install specialized software from the store. Google Play. There are many utilities created solely for one purpose: to tell you whether your device is rooted or not. They scan the system for superuser binaries and check for installed rights managers, such as Magisk or SuperSU.
One of the most popular tools is the application Root Checker. Once launched, it asks for permission to run commands as the superuser. If you have permission, you will see a green confirmation; if not, a red screen with a message about no access. It is important to note that such apps do not provide the rights themselves, but only state the fact of their existence.
⚠️ Attention: Some banking applications and services with a high degree of security (for example, Google Pay or Sberbank Online) can block the work of root detectors or show a false negative result if the system tries to hide the presence of modifications.
In addition to simple checks, There are more advanced utilities that show detailed information about the rooting method. They can determine whether a system partition or a system-less injection method is being used. This is useful if you plan to update the firmware over the air (OTA), since the presence of system changes often blocks automatic updates.
Checking via computer and debugging via USB (ADB)
For deeper diagnostics, especially if you don’t want to install unnecessary applications on your phone, using a computer and tools is ideal ADB (Android Debug Bridge). This method requires first activating the developer mode on the smartphone and connecting the cable to the PC. It gives the most accurate result, since it works at the system shell level.
After connecting the device and setting up the drivers, you need to open a command line or terminal on your computer. Enter the command to enter the device shell. If root access is present and configured correctly, the command prompt symbol will change from $ to #, which is a standard indicator of superuser privileges in the Linux/Unix environment.
adb shell
su
If after entering the command su a request for rights appears on the smartphone screen (from an application like Magisk), and in the terminal the cursor will change to #, which means access is active. If you do not have rights, you will receive a message Permission denied or simply remain in normal user mode. This method is reliable in that it checks the actual ability to execute commands, and not just the presence of files.
If the 'su' command is not found, but you suspect the presence of root, try executing 'which su'. Sometimes the path to the executable file is not specified in the standard shell environment variables.
It is worth considering that modern security systems can block access via ADB even if you have root, if the corresponding option is not enabled in the developer settings. Also, some devices require confirmation of USB debugging each time you connect to a new computer, which can complicate the quick verification process.
Manual analysis of the file system
For experienced users who prefer not to trust third-party software, there is a method of manually checking the presence of key files in system directories. To do this, you will need a file manager with access to the root file system, for example Root Explorer or Solid Explorer (in root mode). If an application immediately asks for superuser rights upon startup, this is the first sign of their presence.
You need to go to the directory /system/bin/ or /system/xbin/ and look for a file named su. The presence of this executable file is direct evidence that a user switching mechanism has been implemented in the system. It is also worth checking the presence of folders characteristic of popular rights managers, such as /data/adb/magisk/ or /system/app/SuperSU/.
| Path to file/folder | What does presence mean | Probability of having root |
|---|---|---|
/system/bin/su |
Classic binary superuser | High (Legacy) |
/data/adb/magisk |
Installed Magisk manager | Very high |
/system/xbin/daemonsu |
Superuser daemon (old methods) | Medium |
/cache/.superuser |
Temporary rights settings files | Medium |
However, you should remember that the presence of a file su does not always guarantee the functionality of the rights. The file may be broken or may not have the correct permissions (chmod). Additionally, modern root hiding methods can mask these files from regular file managers, showing a clean system until a specialized browsing mode is launched.
Why might files be missing?
Modern rooting methods, such as Magisk Hide or the systemless approach, may not create visible files in standard /system directories to bypass security checks applications.
Indirect signs of having superuser rights
Sometimes you can check the presence of root without special commands, simply by paying attention to the behavior of the device and the installed software. There are applications that physically cannot function without administrator rights. If your device runs apps for deep freezing applications (not using standard means), changes to fonts in the system interface, or full backups of all data including protection, most likely the rights are active.
It is also worth looking at the list of installed applications. The presence of icons with the image of a skull (classic logo SuperSU) or a mask (logo Magisk) in the general list of apps is a direct indication of a modification of the system. Even if these applications are hidden from the launcher, they will be visible in the settings in the “Applications” section.
- 🛡️ Applications for blocking ads at the host level (for example, AdAway) require writing to the system hosts file, which is impossible without root.
- ⚙️ Utilities for overclocking the processor and controlling voltage (Kernel Adiutor) work only with the system kernel.
- 📸 Cameras with RAW support and manual DSLR level settings often use root to access the hardware capabilities of the sensor.
Another indirect sign may be the strange behavior of banking applications. If Sberbank, Tinkoff or Google Wallet refuse to start, giving an error about a violation of system integrity or the presence of security threats, this often indicates an unlocked bootloader and acquired superuser rights.
⚠️ Attention: Do not try to remove suspicious system files manually if you are not sure of their purpose. Removing critical components can lead to a “bricked” device and the impossibility of booting it.
Checking the status of the bootloader and system integrity
Having root access is almost always associated with an unlocked bootloader. Checking its status can provide indirect confirmation of interference in the system. On many devices, when turned on, a warning appears on the screen that the bootloader is unlocked, or the corresponding message is displayed in Fastboot mode.
To check, you can use the fastboot commands via a computer. After connecting the phone in bootloader mode, enter the command to check the status. If the device reports unlocked, then the way to install custom recovery and obtain rights has been opened. However, it is worth remembering that it is theoretically possible to have an unlocked bootloader, but not have root access installed.
fastboot getvar unlockedThere are also applications that check the integrity of the system, such as SafetyNet Fix or built-in diagnostic tools. They analyze the signature of the system partition. If the signature does not match the official one (which is inevitable when receiving root), the test will not pass. This is an important marker for those who buy a used phone and want to make sure it is “clean.”
An unlocked bootloader is the foundation for getting root, but in itself it does not mean that superuser rights are already active in a running system.
Risks and consequences of using root access
Understanding how to check root is inextricably linked to understanding the risks it carries. Obtaining superuser rights removes many software restrictions imposed by the manufacturer, but at the same time voids the device warranty and increases vulnerability to viruses. Malware that gains root access can steal any data, including passwords and encryption keys.
In addition, using root violates security mechanisms Androidsuch as SELinux and data encryption. This may cause some security features to no longer function correctly. For example, the “Find Device” function may become ineffective if an attacker can disable it at the system level.
- 💸 Complete loss of warranty from the manufacturer if the fact of software modification is detected.
- 🔒 Inability to use secure NFC payment systems without complex manipulations to hide the root.
- 📉 Potential system instability, frequent reboots or driver errors.
If you found root on your device and did not install it intentionally, this is an alarming signal. Perhaps the previous owner tried to hide traces of repairs or installation of illegal software. In this case, it is recommended to perform a full factory reset (Wipe Data/Factory Reset) via Recovery mode to remove all modifications and return the device to its original state.
⚠️ Attention: Protection implementation details and verification methods may vary depending on the Android version and processor manufacturer. Always check the information with the official support forums for your specific device model.
☑️ Actions if someone else's root is detected
Frequently asked questions (FAQ)
Is it possible to remove root access and return warranty?
Technically, you can remove root by performing a hard reset or flashing it with stock firmware. However, the unlocked bootloader flag (Knox on Samsung and analogues) often works irreversibly. Even after returning to the factory software, the service center may see a physical activation counter, which will void the warranty.
Why does the Root Checker application show that there are no rights, although they are?
This can happen if the root hiding function is used (for example, Magisk Hide or Zygisk). The rights manager specifically masks its presence from verification applications so that banking apps work correctly. Try disabling hiding for a specific detector application.
Is it dangerous to buy a used phone with root access?
Buying such a device carries risks. The previous owner may have introduced highly privileged malware that is not removed by a normal reset. In addition, such phones are often used for cryptocurrency mining in the background, which reduces battery and processor life.
Does root affect receiving system updates over the air (OTA)?
Yes, in most cases, having a modified system partition blocks the installation of official OTA updates. The system checks the integrity of files before updating, and if changes are detected, the process is interrupted. To update, you will need to manually install the firmware via a computer.