[AT&T Samsung Galaxy S 5] johnkirchner:
This is the information I have gathered on KingRoot (for Windows). Please note that this is information gained by using a network monitor and the software was not reversed engineered or decompiled in any way. I am not responsible for how you use this information or any opinion you may form of this software. Lastly I am not responsible for any files downloaded or links followed from this information! Sorry, had to cover myself from slander and those who don't know what they could be getting in to ;)

It appears to be a server side style of app. The app you install either on your phone or pc is simply the gateway to the server and the app knows how to communicate with the server. All functionality appears to be controlled server side, it should (theoretically) not matter what version of the app you are using. The Windows app for this will install the latest android version on your phone, if you do not have it installed already. It actually installs the KingRoot app but also another app named "KrHelper4Pc". This could be the stuff listed in the links and information below, I do not know for fact. The windows app is also in Chinese (I assume). However, they have an unhelpful English page that tells you how to root with the Chinese (I assume) all over it! https://kingroot.net/root-installation-via-windows-pc/

Here are some links that were found having communication:

1. http://103.7.29.26/download.sj.qq.com/qpmgr/AndroidDeviceV6.zip?mkey=58692fabc55ab7b0&f=105&c=0&p=.zip

- This is weird, it downloads a zip file but can not be opened or extracted. I know sometimes .apk files can show as .zip files, so I changed the extension to .apk and moved to my phone sdcard. Can not parse the package...no idea what this file is or how it works! You can open the zip file with wordpad and see a bunch of garbled text though.

-- http://download.sj.qq.com/qpmgr is shown as unsafe by Microsoft Safe Screen (fyi).

2. http://mp.kingroot.net/qrcode?desc=samsung%2Fklteuc%2Fklteatt:5.1.1%2FLMY47X%2FG900AUCU4COI5:user%2Frelease-keys%7CLinux%20version%203.4.0-5869384%20(dpi@SWHD4323)%20(gcc%20version%204.8%20(GCC)%20)%20%231%20SMP%20PREEMPT%20Tue%20Sep%2022%2021:22:27%20KST%202015%7C100302&sceneType=fp&app=3

- This site leads to a QR Code at the following: https://mp.weixin.qq.com/cgi-bin/showqrcode?ticket=gQHZ7zwAAAAAAAAAAS5odHRwOi8vd2VpeGluLnFxLmNvbS9xLzAySEtERkExWHZic2UxdDVTWTFvMVMAAgRFaVVYAwQAjScA

-- Using a QR Scanner on my phone, it leads to a "webpage not available".

3. http://androidpc.app.qq.com/app1/vertis.do?id=20120810003

- Leads to: http://s.pcapps.qq.com/msoft/xml/qqapp_update_20151029.xml which does not display anything, appears to be xml file. Oddly, can not right click and view source though...

Again, this is purely information I have gathered on the use of KingRoot, take it as you wish or as you interpret it. It may (or have) work but there seems to be a lot of other traffic going on, I can not really say if it is necessarily good or bad but I would at least call it "possibly suspicious". The reason I say possibly suspicious is the fact that most "hack tools" are actually not nefarious or do not have bad intentions. They are listed this way to dissuade people from using them. If it shows as a virus, most people will not install or use the program thinking they will get infected when the app is truly not a virus or malicious.

How do I know?

Well, I cant guarantee that any software or app is safe if I did not code it. Back in the day, I used to hack the old Yahoo Messenger login protocol. By doing so, I could create bot programs that could spam, send boot codes to knock them offline and even clone other users. As you can guess, Yahoo did not like this. Yahoo then worked with anti virus companies to get programs like mine listed as a virus to dissuade people from installing them. When this happened, my inbox exploded with people screaming and cussing at me. None of my software is malicious, I would not do that. I ended up releasing my source code to prove it was safe.

Anyways, long story short...for tools like these, it is actually hard to prove if they are malicious, even if a website says so.