宜博 / pixelphone

termux-su-wrapper-analysis.md 2.46 KB

Termux su Wrapper Analysis

Session Context

  • Date: 2026-06-25
  • Device: Android 16 (Termux)
  • Issue: WeChat data extraction failed because Discovery Agent reported "No su program found"
  • User correction: Device IS rooted with Magisk, but Termux's wrapper couldn't find su

Key Finding: Termux's su is a Wrapper Script

Path: /data/data/com.termux/files/usr/bin/su

Content:

#!/data/data/com.termux/files/usr/bin/sh

unset LD_LIBRARY_PATH LD_PRELOAD

for p in /debug_ramdisk/su /sbin/su /system/sbin/su /system/bin/su /system/xbin/su /su/bin/su /magisk/.core/bin/su
do
    if [ -x $p ]; then
        # The su tool may require programs in PATH:
        PATH=/debug_ramdisk:/sbin:/sbin/su:/su/bin:/su/xbin:/system/bin:/system/xbin \
            exec $p "$@"
    fi
done

echo "No su program found on this device. Termux"
echo "does not supply tools for rooting, see e.g."
echo "http://www.androidcentral.com/root for"
echo "information about rooting Android."
exit 1

Critical Insight

The wrapper searches these paths IN ORDER:

  1. /debug_ramdisk/su
  2. /sbin/su
  3. /system/sbin/su
  4. /system/bin/su
  5. /system/xbin/su
  6. /su/bin/su
  7. /magisk/.core/bin/su

If Magisk's su is NOT in any of these paths, the wrapper fails even if root is active.

What We Found on This Device

  • Magisk app installed: com.topjohnwu.magisk ✓
  • /data/adb/ directory: does NOT exist
  • /data/adb/magisk/ directory: does NOT exist
  • All standard su paths: EMPTY
  • Termux wrapper: FAILS with "No su program found"

Hypothesis

Magisk is installed but:

  1. Zygisk is hiding su from Termux's namespace
  2. OR su binary is in a non-standard path not checked by the wrapper
  3. OR Magisk installation is incomplete (app installed but binaries not deployed)

Resolution Path

  1. Open Magisk app to check:

    • Is "Zygisk" enabled? (Disable it to expose su)
    • Is Termux in the denylist? (Remove it)
    • Does Superuser tab show any granted apps?

  2. If Zygisk is required:

    • Add Termux to Magisk's allowlist
    • Or use a direct su path if known

  3. If Magisk is broken:

    • Re-flash Magisk via recovery
    • Or use a different root method

Lessons Learned

  1. NEVER trust "No su program found" at face value
  2. ALWAYS read the wrapper script to understand what paths are checked
  3. Magisk app being installed ≠ su binary being accessible
  4. Discovery agents that use su -c "id" will fail on Termux if wrapper can't find binary
  5. User may be right about root being present — the issue is usually path/visibility