Let's say you got a rooted Android phone but you want to find out how it was rooted. Is there a way to know which method was used to root it?
In general, no.
The basic goal of rooting is to place an executable su
binary somewhere accessible via $PATH
. Nothing else needs to be left behind. The specific exploit that was used need not have side-effects, and multiple different tools could use the same exploit anyways. In fact, there need not even be an exploit — many devices just let you unlock the bootloader and flash or otherwise load su
in a straightforward manner.
If you know that a specific root tool does leave behind a signature, you could check for it, but in my experience that is not typical.