# AVD - Android Virtual Device

{{#include ../../banners/hacktricks-training.md}}

Asante sana kwa [**@offsecjay**](https://twitter.com/offsecjay) kwa msaada wake wakati wa kuunda maudhui haya.

## Nini

Android Studio inaruhusu **kuendesha mashine pepe za Android ambazo unaweza kutumia kujaribu APKs**. Ili kuvitumia utahitaji:

- The **Android SDK tools** - [Download here](https://developer.android.com/studio/releases/sdk-tools).
- Or **Android Studio** (with Android SDK tools) - [Download here](https://developer.android.com/studio).

Katika Windows (kwangu) **baada ya kusakinisha Android Studio** nilipata **SDK Tools zimesakinishwa katika**: `C:\Users\<UserName>\AppData\Local\Android\Sdk\tools`

Katika mac unaweza **kupakua SDK tools** na kuwa nazo kwenye PATH kwa kukimbia:
```bash
brew tap homebrew/cask
brew install --cask android-sdk
```
Au kutoka kwa **Android Studio GUI** kama ilivyoonyeshwa katika [https://stackoverflow.com/questions/46402772/failed-to-install-android-sdk-java-lang-noclassdeffounderror-javax-xml-bind-a](https://stackoverflow.com/questions/46402772/failed-to-install-android-sdk-java-lang-noclassdeffounderror-javax-xml-bind-a) ambayo itawasakinisha katika `~/Library/Android/sdk/cmdline-tools/latest/bin/` na `~/Library/Android/sdk/platform-tools/` na `~/Library/Android/sdk/emulator/`

Kwa matatizo ya Java:
```java
export JAVA_HOME=/Applications/Android\ Studio.app/Contents/jbr/Contents/Home
```
## GUI

### Andaa Mashine ya Virtual

Ikiwa umeweka Android Studio, unaweza kufungua tu muonekano mkuu wa mradi na kufikia: _**Tools**_ --> _**AVD Manager.**_

<div align="center" data-full-width="false">

<figure><img src="../../images/image (1142).png" alt="" width="293"><figcaption></figcaption></figure>

</div>

Kisha, bonyeza _**Create Virtual Device**_

<figure><img src="../../images/image (1143).png" alt="" width="188"><figcaption></figcaption></figure>

_**chagua** simu unayotaka kutumia_ na bonyeza _**Next.**_

> [!WARNING]
> Ikiwa unahitaji simu yenye Play Store imewekwa chagua ile yenye ikoni ya Play Store!
>
> <img src="../../images/image (1144).png" alt="" data-size="original">

Katika muonekano wa sasa utaweza **kuchagua na kupakua image ya Android** ambayo simu itakayotumia itakimbia:

<figure><img src="../../images/image (1145).png" alt="" width="375"><figcaption></figcaption></figure>

Hivyo, chagua na ikiwa haijapakuliwa bonyeza alama ya _**Download**_ kando ya jina (**now wait until the image is downloaded).**\
Mara image itakapopakuliwa, chagua **`Next`** na **`Finish`**.

Mashine ya virtual itaumbwa. Sasa **kila wakati utakapoingia AVD manager itakuwa present**.

### Endesha Mashine ya Virtual

Ili ku**endesha** bonyeza tu _**Start button**_.

![](<../../images/image (518).png>)

## Zana ya Command Line

> [!WARNING]
> Kwa macOS unaweza kupata zana ya `avdmanager` katika `/Users/<username>/Library/Android/sdk/tools/bin/avdmanager` na `emulator` katika `/Users/<username>/Library/Android/sdk/emulator/emulator` kama zimewekwa.

Kwanza kabisa unahitaji **kuamua ni simu gani unayotaka kutumia**, ili kuona orodha ya simu zinazowezekana endesha:
```
C:\Users\<UserName>\AppData\Local\Android\Sdk\tools\bin\avdmanager.bat list device

d: 0 or "automotive_1024p_landscape"
Name: Automotive (1024p landscape)
OEM : Google
Tag : android-automotive-playstore
---------
id: 1 or "Galaxy Nexus"
Name: Galaxy Nexus
OEM : Google
---------
id: 2 or "desktop_large"
Name: Large Desktop
OEM : Google
Tag : android-desktop
---------
id: 3 or "desktop_medium"
Name: Medium Desktop
OEM : Google
Tag : android-desktop
---------
id: 4 or "Nexus 10"
Name: Nexus 10
OEM : Google
[...]
```
Mara tu umeamua jina la kifaa unalotaka kutumia, unahitaji **kuamua ni Android image gani unayotaka kuendesha kwenye kifaa hiki.**\
Unaweza kuorodhesha chaguzi zote ukitumia `sdkmanager`:
```bash
C:\Users\<UserName>\AppData\Local\Android\Sdk\tools\bin\sdkmanager.bat --list
```
Na **pakua** ile (au zote) unayotaka kutumia na:
```bash
C:\Users\<UserName>\AppData\Local\Android\Sdk\tools\bin\sdkmanager.bat "platforms;android-28" "system-images;android-28;google_apis;x86_64"
```
Mara baada ya kupakua image ya Android unayotaka kutumia, unaweza **kuorodhesha picha zote za Android zilizopakuliwa** kwa:
```
C:\Users\<UserName>\AppData\Local\Android\Sdk\tools\bin\avdmanager.bat list target
----------
id: 1 or "android-28"
Name: Android API 28
Type: Platform
API level: 28
Revision: 6
----------
id: 2 or "android-29"
Name: Android API 29
Type: Platform
API level: 29
Revision: 4
```
Wakati huu umeamua kifaa unachotaka kutumia na umepakua imaji ya Android, hivyo **unaweza kuunda mashine pepe kwa kutumia**:
```bash
C:\Users\<UserName>\AppData\Local\Android\Sdk\tools\bin\avdmanager.bat -v create avd -k "system-images;android-28;google_apis;x86_64" -n "AVD9" -d "Nexus 5X"
```
Katika amri ya mwisho **nilitengeneza VM iliyoitwa** "_AVD9_" kwa kutumia **kifaa** "_Nexus 5X_" na **Android image** "_system-images;android-28;google_apis;x86_64_".\
Sasa unaweza **kuorodhesha virtual machines** ulizozitengeneza kwa:
```bash
C:\Users\<UserName>\AppData\Local\Android\Sdk\tools\bin\avdmanager.bat list avd

Name: AVD9
Device: Nexus 5X (Google)
Path: C:\Users\cpolo\.android\avd\AVD9.avd
Target: Google APIs (Google Inc.)
Based on: Android API 28 Tag/ABI: google_apis/x86_64

The following Android Virtual Devices could not be loaded:
Name: Pixel_2_API_27
Path: C:\Users\cpolo\.android\avd\Pixel_2_API_27_1.avd
Error: Google pixel_2 no longer exists as a device
```
### Endesha Mashine ya Virtual

> [!WARNING]
> Kwa macOS unaweza kupata zana ya `avdmanager` katika `/Users/<username>/Library/Android/sdk/tools/bin/avdmanager` na `emulator` katika `/Users/<username>/Library/Android/sdk/emulator/emulator` ikiwa zimewekwa.

Tayari tumeona jinsi unavyoweza kuorodhesha mashine za virtual ulizozitengeneza, lakini **unaweza pia kuorodhesha kwa kutumia**:
```bash
C:\Users\<UserName>\AppData\Local\Android\Sdk\tools\emulator.exe -list-avds
AVD9
Pixel_2_API_27
```
Unaweza kwa urahisi **kuendesha mashine pepe yoyote iliyoundwa** ukitumia:
```bash
C:\Users\<UserName>\AppData\Local\Android\Sdk\tools\emulator.exe -avd "VirtualMachineName"
C:\Users\<UserName>\AppData\Local\Android\Sdk\tools\emulator.exe -avd "AVD9"
```
Au kwa kutumia chaguo za juu zaidi, unaweza kuendesha virtual machine kama:
```bash
C:\Users\<UserName>\AppData\Local\Android\Sdk\tools\emulator.exe -avd "AVD9" -http-proxy 192.168.1.12:8080 -writable-system
```
### Chaguo za mstari wa amri

Hata hivyo kuna **chaguzi nyingi tofauti za mstari wa amri zinazofaa** ambazo unaweza kutumia kuanzisha mashine pepe. Hapa chini unaweza kupata baadhi ya chaguzi zenye kuvutia lakini unaweza [**find a complete list here**](https://developer.android.com/studio/run/emulator-commandline)

**Boot**

- `-snapshot name` : Anzisha snapshot ya VM
- `-snapshot-list -snapstorage ~/.android/avd/Nexus_5X_API_23.avd/snapshots-test.img` : Orodhesha snapshots zote zilizorekodiwa

**Network**

- `-dns-server 192.0.2.0, 192.0.2.255` : Inaruhusu kuainisha kwa koma seva za DNS kwa VM.
- **`-http-proxy 192.168.1.12:8080`** : Inaruhusu kuainisha HTTP proxy ya kutumia (muhimu sana kwa kunasa trafiki kwa kutumia Burp)
- If the proxy settings aren't working for some reason, try to configure them internally or using an pplication like "Super Proxy" or "ProxyDroid".
- `-netdelay 200` : Weka emulation ya ucheleweshaji wa mtandao kwa millisekunde.
- `-port 5556` : Weka nambari ya port ya TCP inayotumika kwa console na adb.
- `-ports 5556,5559` : Weka port za TCP zinazotumika kwa console na adb.
- **`-tcpdump /path/dumpfile.cap`** : Inakamata trafiki yote katika faili

**System**

- `-selinux {disabled|permissive}` : Weka moduli ya usalama ya Security-Enhanced Linux kuwa disabled au permissive kwenye mfumo wa uendeshaji wa Linux.
- `-timezone Europe/Paris` : Weka timezone kwa kifaa pepe
- `-screen {touch(default)|multi-touch|o-touch}` : Weka mode ya skrini ya kugusa iliyohamirishwa.
- **`-writable-system`** : Tumia chaguo hili ili kuwa na system image inayoweza kuandikwa wakati wa kipindi chako cha emulation. Pia utahitaji kuendesha `adb root; adb remount`. Hili ni muhimu sana kusakinisha cheti jipya kwenye mfumo.

## Usanidi wa CLI ya Linux (SDK/AVD quickstart)

Zana rasmi za CLI zinafanya iwe rahisi kuunda emulators za haraka, zinazoweza kufanyiwa debug bila Android Studio.
```bash
# Directory layout
mkdir -p ~/Android/cmdline-tools/latest

# Download commandline tools (Linux)
wget https://dl.google.com/android/repository/commandlinetools-linux-13114758_latest.zip -O /tmp/cmdline-tools.zip
unzip /tmp/cmdline-tools.zip -d ~/Android/cmdline-tools/latest
rm /tmp/cmdline-tools.zip

# Env vars (add to ~/.bashrc or ~/.zshrc)
export ANDROID_HOME=$HOME/Android
export PATH=$ANDROID_HOME/cmdline-tools/latest/bin:$ANDROID_HOME/platform-tools:$ANDROID_HOME/emulator:$PATH

# Install core SDK components
sdkmanager --install "platform-tools" "emulator"

# Install a debuggable x86_64 system image (Android 11 / API 30)
sdkmanager --install "system-images;android-30;google_apis;x86_64"

# Create an AVD and run it with a writable /system & snapshot name
avdmanager create avd -n PixelRootX86 -k "system-images;android-30;google_apis;x86_64" -d "pixel"
emulator -avd PixelRootX86 -writable-system -snapshot PixelRootX86_snap

# Verify root (debuggable images allow `adb root`)
adb root
adb shell whoami  # expect: root
```
Vidokezo
- System image flavors: google_apis (debuggable, inaruhusu `adb root`), google_apis_playstore (not rootable), aosp/default (lightweight).
- Build types: userdebug mara nyingi inaruhusu `adb root` kwenye images zenye debug-capability. Play Store images ni production builds na huzuia root.
- On x86_64 hosts, full-system ARM64 emulation is unsupported from API 28+. For Android 11+ tumia Google APIs/Play images ambazo zinajumuisha per-app ARM-to-x86 translation ili kuendesha apps nyingi za ARM-only kwa haraka.

### Snapshots kutoka kwa CLI
```bash
# Save a clean snapshot from the running emulator
adb -s emulator-5554 emu avd snapshot save my_clean_setup

# Boot from a named snapshot (if it exists)
emulator -avd PixelRootX86 -writable-system -snapshot my_clean_setup
```
## ARM→x86 binary translation (Android 11+)

Google APIs na Play Store images kwenye Android 11+ zinaweza kutafsiri binaries za app za ARM kwa kila mchakato huku zikihifadhi sehemu nyingine za mfumo kuwa native x86/x86_64. Hii mara nyingi ni ya kutosha kwa kasi kujaribu apps nyingi zinazotegemea ARM tu kwenye desktop.

> Kidokezo: Pendelea Google APIs x86/x86_64 images wakati wa pentests. Play images ni rahisi lakini huzuia `adb root`; zitumie tu unapohitaji Play services kwa mahsusi na ukikubali ukosefu wa root.

## Rooting a Play Store device

Ikiwa umepakua kifaa chenye Play Store hutaweza kupata root moja kwa moja, na utapata ujumbe huu wa kosa
```
$ adb root
adbd cannot run as root in production builds
```
Kwa kutumia [rootAVD](https://github.com/newbit1/rootAVD) pamoja na [Magisk](https://github.com/topjohnwu/Magisk) niliweza kui-root (fuata kwa mfano [**video hii**](https://www.youtube.com/watch?v=Wk0ixxmkzAI) **au** [**hii nyingine**](https://www.youtube.com/watch?v=qQicUW0svB8)).

## Sakinisha Cheti cha Burp

Angalia ukurasa ufuatao ili kujifunza jinsi ya kusakinisha cheti maalum cha CA:


{{#ref}}
install-burp-certificate.md
{{#endref}}

## Chaguzi Nzuri za AVD

### Chukua Snapshot

Unaweza **kutumia GUI** kuchukua snapshot ya VM wakati wowote:

![](<../../images/image (234).png>)

## Marejeo

- [Build a Repeatable Android Bug Bounty Lab: Emulator vs Magisk, Burp, Frida, and Medusa](https://www.yeswehack.com/learn-bug-bounty/android-lab-mobile-hacking-tools)
- [Android Emulator command line](https://developer.android.com/studio/run/emulator-commandline)
- [Run ARM apps on the Android Emulator (x86 translation)](https://android-developers.googleblog.com/2020/03/run-arm-apps-on-android-emulator.html)

{{#include ../../banners/hacktricks-training.md}}