yashsingh1/xdaforums huggingface dataset:
[Xposed Framework Modules] Spikelangelo:
Thanks again. This worked.

For reference here's my working setup to hide root from MaaS360 on Lollipop:

-AT&T Samsung Galaxy S5

-Stock rooted deodexed 5.0 Lollipop (I thought MaaS360 would only work on the odex version but I was wrong)

-Xposed alpha 3 (would not work on alpha 4) (I also previously missed that Lollipop Xposed needs deodexed ROM)

-RootCloak 1.3
[Xposed Framework Modules] Qrek:
Bank of Scotland

App is no working with Bank of Scotland app
[Xposed Framework Modules] Akopps:
Tried rootcloak 1.4 with AT&T U-verse App, which apparently started checking for root in June. It didn't work. U-verse app simply exits with an error on startup. I did add u-verse app to the list of cloaked packages.

As for rootcloak 1.3, it doesn't seem to have any effect on the u-verse app. It starts, but does not play any live content. Shows error 1507.
[Xposed Framework Modules] KemikalElite:
Hi can confirm. I was just about to post about this.

While the app isn't the greatest it would be worth it to make it compatible with RootCloak.

Unfortunately Its not possible to roll back the app to an old version because they disable it.
[Xposed Framework Modules] xbeda:
Horizon Go

Hi,

Have you been somebody successful with Horizon Go? The current version 2.2.1 crashes with RootCloak 1.3 or 1.4.

I read a older discussion, but without any conclusion.
[Xposed Framework Modules] _PrEzi_:
Nope... I also am trying to find a working solution for it... In case someone finds one --- please share...
[Xposed Framework Modules] Wompatti:
Nordea Mobiletoken

Hi,

I just tested RootCloak with rooted Samsung Galaxy Note 10.1 (N8020), also known as I925. Nordea Bank uses Mobiletoken software installed to users Android device to authenticate in mobile banking. They say it won't work with rooted devices, but it works with RootCloak. I just tested it successfully.

Play Store id for the program is com.nordea.mobiletoken. I can't post direct link because I have not enough messages yet.
[Xposed Framework Modules] Bec de Xorbin:
Yeah, in Lollipop version 1.3 was needed though.
[Xposed Framework Modules] darkslider909:
I just tried out the new HBO Now app and discovered as others have about not working on rooted devices.

I'm running ARHD 91.1 on a T-mobile HTC One M7. Rooted and running Xposed with the latest RootCloak module.

I tried adding the HBO app to the list in RootCloak and reboot. Also tried changing Superuser default from Grant to Prompt.

Was going to try RootCloak Plus but saw a post on that thread about HBO Now still getting blocked.

I wonder if the HBO app is just looking for the Superuser app to be installed, and thus knows the device is rooted? What other ways can an app detect root access?

Thanks for everyone's hard work!
[Xposed Framework Modules] ecksdeeay:
Just temporarily disable SU then remember to wipe away the banking app from tasks before enabling SU again, I showed how it works for Bank of Scotland apps i.e Halifax, back in this thread [emoji6]
[Xposed Framework Modules] darkslider909:
I tried Hide My Root which basically does that, hides the su binary. Still doesn't work sadly. I think it might be detecting the custom ROM but who knows? It did play video for a few seconds longer than before, so I'm guessing it has multiple checks for root.
[Xposed Framework Modules] ecksdeeay:
If you replace your SU app with SuperSU, there is a switch to tick on/off SU access.
[Xposed Framework Modules] devadvance:
These apps all probably use native libraries to check for root. I verified that with pushTAN, but the others I haven't had a chance to decompile/disassemble yet.

Try RootCloak v1.2. I added blocking "sh" execution directly, which is how Yuppi checks for root(sh, followed by ls -l /system/xbin/su).

If a apps don't crash as a result of blocking "sh", I'll leave it in there, but if they do I'll change it to a case-by-case basis.
[Xposed Framework Modules] kalvin807:
Anyone tested it with puzzle and dragon (Japanese version)???I Thanks you
[Xposed Framework Modules] darren1:
On a rooted supported device without a custom rom Sky Go will work if SuperSU is uninstalled and busybox and su removed.

http://xdaforums.com/showpost.php?p=40623690&postcount=2776
[Xposed Framework Modules] xcly:
KB Star Banking, Shinhan Smart Banking apps detect root. Is there a way to fool apps to thinking the name of files/folders on /system is different to what they are?
[Xposed Framework Modules] skedone:
Nope virgin media tv still detects it
[Xposed Framework Modules] H89P:
The s-tan doesn't FC but still recognizes root on 1.2
[Xposed Framework Modules] ameerzainal:
Not working on Asphalt 8 :(
[Xposed Framework Modules] namaste74:
Tried my TV providers app (Ziggo)

https://play.google.com/store/apps/details?id=nl.ziggo.android.tv

Didn't work, hopefully you find a way, cause i hate having to use a modded app to remove the root check, always a few versions behind. For anyone wanting a modded ziggo app, look here http://xdaforums.com/showthread.php?t=2440369.
[Xposed Framework Modules] Fenny:
Played with IDA for a bit, and found this:

fd800095: ["XferManager", "149", "3", "12", "fd800095", "XFERM_DEVICE_JAIL_BROKEN_ROOTED", "S", "a+b", "true", " Device is jail broken/rooted"],

-0x27fff6b = fd800095 as an unsigned dword. The DirecTV app uses the same value for that error. Whatever the root check actually does it collects data, sends it to the Sky/DTV server, and what is returned is the fd800095 error code if the device is rooted. I found a single cstring reference to "system" in the libvgc.so file, as well as a bunch of java function defs in both of the lib files. Looks like there are a lot of method calls by reflection going on.

*EDIT*

Did a little more digging, it looks like when the playback is supposed to start an intent is created, and it loads an extra value called "status" from the intent, if that value does not match "0x3d8c0090" then onPlaybackFailure gets called, and the error handler is called, which is where we find our call to display the error.

Looks like there is only one function that crafts an intent with this extra: statusEventArrived(JII)V

or the java signature:

public void statusEventArrived(long aLong, int anInt, int anotherInt);

*Edit2*

Found the following function call in the exports of libvgc.so: Java_com_nds_vgdrm_impl_base_VGDrmBaseService_natRegisterListener

which calls opfDsjLBIaslInFqUvIjJcF which in turn calls statusEventArrived.

Aaaand... in VGDemBaseService.smali:

.method native natRegisterListener(ILjava/lang/Object;)I
.end method
[Xposed Framework Modules] ThePureHeart:
Damn it. Not working with Barclays app. Can't seem to figure out what they could be doing to detect root. As soon as I open it, SuperSU pops up so it might be SuperSU.

Anyone else tried Barclays app?

Sent from ThePureHeart's I9300 Boss Edition

ParanoidAndroid | Googy-Max
[Xposed Framework Modules] devadvance:
:good: loving the in-depth analysis. Helps to clarify the logic behind the detection, as well as exactly what aspects of the app are involved. The difficulty is since it does the checking at the native level, there's no way to handle this other than to add SkyGo-specific code. Definitely possible :D

The Barclays app does the checks at the native level as well, probably issues an exec*() call. Not sure why they bother do to that actually, considering they could check for root by doing a fopen or stat on the su file.
[Xposed Framework Modules] ThePureHeart:
I wish I understood what all of that meant (not a dev here) :P

Thank you for a brilliant mod, works with several other apps and might work against all these others some day, maybe :D

Sent from ThePureHeart's I9300 Boss Edition

ParanoidAndroid | Googy-Max
[Xposed Framework Modules] alvszapanta:
won't work

Avabel Online Rpg still detects the root
[Xposed Framework Modules] Jspex:
Confirmed root hidden from ISIS app on AT&T.
[Xposed Framework Modules] pcigre:
Thanks for a good work.

Sadly, doesnt work with D3Go TV https://play.google.com/store/apps/details?id=com.zappware.twintv.d3

Any chance to sort this out in some next version?
[Xposed Framework Modules] stillthisguy:
Doesn't work with McAfee EMM
[Xposed Framework Modules] CBers:
Anyone tried this with "Virgin TV Anywhere" please?

Link: https://play.google.com/store/apps/details?id=com.virginmedia.tvanywhere
[Xposed Framework Modules] HDFLucky:
Works great with JuiceDefender (com.latedroid.juicedefender) - it completely eleiminates the "AOSP helper" log errors. However, it was first necessary to clear cache/data on JuiceDefender, open the app and do a restore/enable, and then reboot. It was not necessary to cloak JD Ultimate, as I believe that is just an unlocker.
[Xposed Framework Modules] jed84:
I tried and it doesnt work. I still have "aosp" error.
[Xposed Framework Modules] devadvance:
Not sure why it would have solved the AOSP error for Juice Defender in the first place. That error doesn't have to do with root.
[Xposed Framework Modules] darkslider909:
Already have SuperSU, disabled it and still no luck.
[Xposed Framework Modules] ecksdeeay:
With Bank of Scotland apps, you have to be careful each time it's used to wipe it away from the tasks when re-enabling root. If it still doesn't work it must be HBO has some strict rules?
[Xposed Framework Modules] void513:
any chance you get working with Ragnarok Online: Path of Heroes
[Xposed Framework Modules] frogt9:
Hey guys!

I wonder if there is any way to bypass XignCode security for Asobimo games? Today I've tried to play in new Stellacept (English version test) game from this developer but it didn't launches because... Just take a look on a screenshot. Can someone help me out?
[Xposed Framework Modules] DerpyTails:
The Modules great, It works with Pokémon Jukebox, but sadly for when I tried it with Disney TsumTsum, it crashes the game
[Xposed Framework Modules] thespeed:
I found out that it's working with root but not with Xposed.

As soon if i install the Xposed files within the recovery and clear the cache.

The Horizon app will close when going to the live channels.

After that i dirty flashed the ROM again and it's working again.

So it seems that there's some sort of an Xposed check.

So root just works.

ROM: Cyanogenmod nightly: cm12.1 20150726

Xposed v67 by Romracer

Horizon GO app 2.2.2

Ziggo/UPC the Netherlands

Maybe others can confirm?
[Xposed Framework Modules] _PrEzi_:
So it means it checks the xposed binaries probably... does any1 have an idea how to hide xposed in rootcloak ?

Because normally I am only able to hide commands and keywords... and xposed is already on the list.

EDIT : some ideas from my side to "hide" xposed better -- currently cannot test if it works - someone might want to try it.

Go into RootCloak and add the Horizon app.

Add the following keywords to the list :

XposedBridge

enabled_modules

libxposed

libxposed_art

robv

xposed,prop
[Xposed Framework Modules] thespeed:
Thanks, i tried it but it still quits when opening the live channels.

Maybe they are checking some changed files or the Xposed files?

Or it's just an Xposed/Horizon app bug?

Would be nice if i could create a log. But i am not a programmer ;)
[Xposed Framework Modules] biffcoorbit:
Does it work with airwatch? I cannot load the airwatch agent.
[Xposed Framework Modules] Kopernikus:
Rootcloak + Lollipop

Anyone got a solution?

Without removing "su" from the keywords most apps force close, when removing "su" some work others detecting root (the ones who are checking for "su" obviously).

Tried playing around with the keywords with nu results, we should find a way to have native access to "libwebviewchromium_plat_support.so" while maintaining the "su" keyword.

Hope we find someone who picks-up on the development of this xposed module, since more and more apps do a root check.

I'm more then willing to give a donation to a developer wishing to continue this development.

Thx
[Xposed Framework Modules] Persechini:
I'm also trying to hide root from the ourocard-e app, but failing. I'd like help with what keywords/commands it could possibly be cheking
[Xposed Framework Modules] tapeworm4602:
I'm wondering if it's possible to decompile the apk, doing 'grep' search for root/su triggers then alter the lines in .smali ?
[Xposed Framework Modules] Captain_Throwback:
+1

My organization just move to AirWatch so now it looks as if I'll be stuck with an unrooted device :eek:
[Xposed Framework Modules] hikaritenchi:
Hey, hopefully this gets to you, but I've taken his source and modified it to bypass that specific case (Love Live also has the same issue, with the webview getting replaced). I've made some other (slight, imo) modifications:

Debug messages are always on.

Pressing "up/home" on the action bar is the same as "back" (This was done to remove the support library dependency).

The app now uses XposedBridgeApi-20150213 instead of whatever else was being used.

The app version is 1.4.1, and is considered an upgrade.

Note that I've only tested it on romracer's Xposed for Lollipop 5.1 v69 for ARM based on rovo89's Xposed for 5.0 on my Nexus 6, so YMMV.

I'm going to keep my code modifications to myself for now, until devadvance responds hopefully soon. Unfortunately, I can't link the file, so I'm not going to tempt fate by trying to bypass it, but if you PM me, I'll find a way to get it to you.
[Xposed Framework Modules] Lostgeek:
Dutch bank SNS app confirmed installing, but not working. Stops during setup process

https://play.google.com/store/apps/details?id=nl.snsbank.snsbankieren
[Xposed Framework Modules] ssms:
Does not work on OTE TV GO app on Google Play... gr.ote.otetvgo.androidphone

Please fix!
[Xposed Framework Modules] _PrEzi_:
Eagerly awaiting some more news from you then :)

I am crossing my fingers that the update will work with Horizon app...
[Xposed Framework Modules] fhk:
Wow, would be awesome if you could share your update. I miss this module so much (for dme) .
[Xposed Framework Modules] hikaritenchi:
Yeah, I'd love to share my updates, but I can't post any links. I can PM the link out, I guess, but I'd like to try and get my post count up as well so I can post links, haha.
[Xposed Framework Modules] thecarp1975:
Anyone know where I could find a version where i could McAfee EMM to work?
[Xposed Framework Modules] Kopernikus:
Can't wait to test this :) thx!!!!!!!!
[Xposed Framework Modules] hikaritenchi:
I've sent a few links out to people who have PM'd me. Again, I only tried to fix the webview issue, but if there are any other problems, let me know and I can try and fix them as well.

I've also changed my email settings, so I get an email whenever someone PMs me or replies to this thread. I apologize for the delay in replying to those who messaged/posted.
[Xposed Framework Modules] DennisvandePut:
I'd love to test your version as well. Thanks
[Xposed Framework Modules] apc:
Hi,

I also have an app that suffers from the webview problem, so would be very interested in testing your version. Thanks :)
[Xposed Framework Modules] Kopernikus:
Your modified version of Rootcloak is working perfectly on my Galaxy S5 Android 5.0 with Xposed V65 by arter69.

The only app who isn't working is "Record Bank" (a homebanking app from a Belgian bank), it starts and hangs, when I disable SU it works, before it was also forced-closing because of the webview issue.

Thanks again and if you have the time would you check what the problem would be with this app?

Thx!
[Xposed Framework Modules] Captain_Throwback:
Can anyone report whether the modified version by [MENTION=3514987]hikaritenchi[/MENTION] fixes the issue with AirWatch detecting root and the device shows as non-compliant? Or perhaps a fix for that can be added?
[Xposed Framework Modules] Sartre:
I would love to try this too! I can´t use HBO Nordic (https://play.google.com/store/apps/details?id=com.hbo.android.app&hl=no) and Get TV (https://play.google.com/store/apps/details?id=com.tvc.get&hl=no) when rooted so I´m excited to see if your version will work.
[Xposed Framework Modules] xetro:
I am having the same issue. I'm thinking the framework itself is the problem....
[Xposed Framework Modules] hikaritenchi:
I'd love to, but I can't download the app from the store. I'd appreciate a direct link to an APK, if possible.

Also, another round of PMs have been sent out. please let me know how testing goes. I didn't expect so much response, but I'll try and keep up. Thanks, everyone!
[Xposed Framework Modules] _PrEzi_:
Unfortunately the Horizon GO app still exists without any error when accessing the LiveTV streams...

No error... nothing... just quits.
[Xposed Framework Modules] austinjklim:
Hopething Xposed comes to s6 asap cant play School Idol Festival with root access :/
[Xposed Framework Modules] hikaritenchi:
Whenever it does, be sure to bug me for the link to my modded apk, 'cause that's what I'm using to play LLSIF xP
[Xposed Framework Modules] austinjklim:
You mean you are able to play both EN SIF and JP SIF on your rooted phone without xposed ? I read somewhere along the forums that you can play on a rooted without xposed if you have a rooted apk. Can you share that with me? Playing on a rooted s6 is so damn horrible that i really regretted didnt really research enough buying the s6
[Xposed Framework Modules] hikaritenchi:
Oh, sorry, no. Back before xposed didn't exist for Lollipop, I just disabled SuperSU to play LLSFIF. It was a pain, but I didn't really need to use SuperSU for a lot of things. In any case, good luck.
[Xposed Framework Modules] Persechini:
Unfortunately the hikaritenchi's test version did not work for the app I needed (https://play.google.com/store/apps/details?id=br.com.bb.oewallet), a Root warning screen pops up as soon as the app loads, preventing further usage. I played around with keywords just like I did with the latest original module, but still no change :(
[Xposed Framework Modules] honki24:
YGPM, looking forward to it! It's taken me a solid 10 hours to figure out how to get my note 3 working with allianceRom and xposed.
[Xposed Framework Modules] hikaritenchi:
Hey there, if you can send me a PM or something with the APK, or send me the logcat, I can try and debug it. Unfortunately, the APK seems to be blocked in my country.
[Xposed Framework Modules] plapic:
The new Optus WiFi Talk detects root.

[IMG="WiFi Talk error"]https://www.dropbox.com/s/wx1cdimex7d3obc/2015-08-12%2023.03.09.png?raw=1[/IMG]
[Xposed Framework Modules] Persechini:
Done!

I'm so used to be on the other side of region restriction that I find it funny when a brazilian app isn't available elsewhere ;)
[Xposed Framework Modules] hikaritenchi:
Upon further reflection, it might be good that I haven't been able to post a public link to my updated app. I suspect that since making it open source, some root-blocking companies might have looked at the source and counteracted the fixes. I'm going to try and change the app even more to change the methods and hide them better.
[Xposed Framework Modules] nscxp2005:
Cool. I'm still having a problem with Barclays Banking App. It launches and then force closes. Hopefully this can be fixed.

Keep up the great work.
[Xposed Framework Modules] NakedFaerie:
For anyone thats getting some root or SU detections what i did to bypass some of them is to load up SuperSU and enable all then uninstall the app only. That way SuperSU doesnt exist and wont get detected, 1 less root/SU detection bypassed. As you enabled everything whatever needs root still gets it thats the only problem everything gets root access. Or just set it up the way you want but you cant have it ask as the app wont be there for it to ask so that way everything will be denied.

I had problems on my tablet but did this and no problems since.

I use this and root cloak and only had 1 app not work, stupid Samsung Wallet but as thats now gone its all good now.
[Xposed Framework Modules] pyler:
His Last Activity: 15th February 2015 . But on github he seems to be active, so send him your patches. You should definitely continue this module.
[Xposed Framework Modules] hikaritenchi:
Update: I've been spending some more time on my day job, so I have less time to work on this project in the short term. I'll try and clean some stuff up, but I'll be at a conference next week, so there might not be any updates until September.
[Xposed Framework Modules] Kopernikus:
No prob, we are happy to see someone is willing to continue this module.
[Xposed Framework Modules] ThunderStick:
Works with Uber partner app
[Xposed Framework Modules] Captain_Throwback:
You might want to try this: http://xdaforums.com/xposed/modules/app-unwatch-root-support-airwatch-t3183082
[Xposed Framework Modules] motoridersd:
OMG. I'm going to have to give that a shot on my Nexus 6 before I try it on the G4. THANK YOU!
[Xposed Framework Modules] vinsh3nt:
How do I remove the binaries like you said?
[Xposed Framework Modules] qwowp:
guys, my nexus 6 currently on pure nexus 5.1.1 rom and I'm sure I have installed the xposed framework correctly cause other modules are working fine.

I've read at many posts that rootcloak is working on android 5.1.1 but I haven't manage to make it work on my phone. Every time I add an app to rootcloak,the app stops working and starts crashing every time I try to open it until I remove it from rootcloak.

Is there something I did wrong here? rootcloak module is already activated in xposed..
[Xposed Framework Modules] kirky2k2:
[MENTION=5789129]qwowp[/MENTION], +1 here, although I'm on a LG G3 D850 on 5.0.1 having just installed xposed and got g3 tweakbox working fine root cloak doesn't work for any app. Lauch an app thats been added to root cloak then it just says unfortunately [insert app] has stopped
[Xposed Framework Modules] GabbyWC:
The mobile app for the bank I use, RBC, updated today and here's its changelog:

RBC Wallet is now available for all Android devices with OS 4.4 or higher, regardless of which mobile network you are on or which SIM card you have on your phone. You can now add any RBC Visa or Interac card to your RBC Wallet. You can view balance on all cards and accounts that you’ve added to your RBC Wallet. To help ensure our customers’ security we have disabled RBC Wallet on Android devices that have been rooted.

It now asks for root access when I start the app. I don't suppose it makes any difference whether I accept or decline the SuperSU prompt for it?
[Xposed Framework Modules] NYLimited:
If it asks for SU rights it is executing the SU app. Have you tried to deny SU access to it via XPrivacy? Not sure if it would help but should be easy to try..

----

You can chose to ignore reality, but you cannot ignore the consequences of ignoring reality.
[Xposed Framework Modules] GabbyWC:
I've never used the XPrivacy module but I wonder if denying the RBC app from having root access would be of any help. When I let the SuperSU prompt time out, I don't see any option for the RBC Wallet feature in the app so I guess it's not accessible.
[Xposed Framework Modules] NYLimited:
I don't know the answer either but it *seems* like the RBC app is blindly calling SU. If you were to temporarily rename SU I wonder what would happen. Anyway, good luck. It was just an idea.

----

You can chose to ignore reality, but you cannot ignore the consequences of ignoring reality.
[Xposed Framework Modules] GabbyWC:
Even with RootCloak installed and configured for the RBC Mobile app, the RBC Wallet feature does not presently work on my rooted Nexus 5. It would be nice if someone could develop a reliable solution for it because I doubt that users are eager to unroot their phones just for a shopping convenience feature.
[Xposed Framework Modules] rupes100:
I would like to know if anyone has gotten the wallet to work on a nexus 5 period. I am unrooted but cannot add a card, just sits and hangs at the choosing pin screen.. Not sure how much testing these guys did..
[Xposed Framework Modules] Vakman:
Yes, this is the exact app I am trying to get working as well.

Also, trying to get Shomi to work but that seems force close when using RootCloak.
[Xposed Framework Modules] ciclolars:
In the app SuperSU, settings active SuperUser unchecked and then reboot.