[Xposed Framework Modules] T2098:
Looks like the MaaS360 app detects root with Android 5.x and RootCloak 1.5.2 as well.

It worked fine with RootCloak 1.4 and CM11 (Android 4.4/Kitkat) but as soon as I upgraded to 1.5.2 root was detected, even with 4.4.

Tried a fresh install of Cm12/5.1 and no go.

Interestingly, it seems to work for a brief second and displays 'compliant', but then after 10-15 seconds it detects root and wipes the device.

This is better than before with trying to get 1.4 to work on Lollipop where at no point would it ever show compliant (or it would just Force Close on the app launching)

I suspect that com.fiberlink.trusteer.rootStatus is detecting root somehow - unfortunately this does not show up in the available applications under RootCloak's settings - perhaps because it's being downloaded and run from within the main MaaS360 app itself? I wonder if manually adding an entry for it (if that's even possible) would allow RootCloak to hide root successfully?

The main application's package is "com.fiberlink.maas360.android.control" and I did add that to RootCloak's app list, obviously.

For troubleshooting purposes, here's an excerpt of the relevant portions of the app's debug log file:

| I | IntentService[Device Attribute Service] | AdvancedRootDetection | BB execution successful
| I | IntentService[Device Attribute Service] | AdvancedRootDetection | Found test-keys in build tags: test-keys
| I | IntentService[Device Attribute Service] | AdvancedRootDetection | Found SuCommand: /system/bin/su
| I | IntentService[Control Service] | ControlAgentIntentHandler | Received intent PERSONA_POLICY_COMPLIANCE_CHECK Current Thread Id: 607
| I | IntentService[Control Service] | PersonaPolicyComplianceCheckServiceImpl | Root device check is required for this device
| I | IntentService[Trusteer Service] | TrusteerHelper | Received intent com.fiberlink.trusteer.rootStatus
| I | IntentService[Trusteer Service] | TrusteerHelper | Completed : com.fiberlink.trusteer.rootStatus in 2ms
| I | pool-10-thread-1 | AbstractWebserviceResource | Size of response: 1819
| I | pool-10-thread-1 | AbstractWebserviceResource | Received xml response for resource RefreshDeviceAuth
| I | pool-10-thread-1 | AbstractWebserviceResource | Request successful of resource RefreshDeviceAuth. Starting to parse response with root tag : authResponse
| I | pool-10-thread-1 | AbstractWebserviceResource | Response succesfully received and parsed for Resource with Tag authResponse
| I | pool-10-thread-1 | AbstractMaaS360WebService | Executing get resource :DeviceIdentityAttributesResource to url:https://services.m2.maas360.com/device-apis/devices/1.0/<removed_android_dev_id>
| I | pool-10-thread-1 | AbstractWebserviceResource | Size of response: 1039
| E | pool-10-thread-1 | AbstractWebserviceResource | Resource:DeviceIdentityAttributesResource received non json/xml content type for parsing
| I | pool-10-thread-1 | AbstractMaaS360WebService | Executing get resource :ADGroups to url:https://services.m2.maas360.com/device-apis/user/1.0/getADGroupsForDeviceUser/<removed_ID>
| I | IntentService[Control Service] | SecurityComplianceInformationCollector | SU FOUND under :/system/bin
| I | pool-10-thread-1 | AbstractWebserviceResource | Size of response: 116
| I | pool-10-thread-1 | AbstractWebserviceResource | Received xml response for resource ADGroups
| I | pool-10-thread-1 | AbstractWebserviceResource | Request successful of resource ADGroups. Starting to parse response with root tag : adGroups
| I | pool-10-thread-1 | AbstractWebserviceResource | Response succesfully received and parsed for Resource with Tag adGroups
| I | IntentService[Upload Service] | UploadIntentHandler | Received intent HIGH_PRIORITY_UPLOAD_INTENT
| I | IntentService[Upload Service] | UploadServiceImpl | Not uploading initial data since initial upload didnt complete
| I | IntentService[Control Service] | PersonaPolicyComplianceCheckServiceImpl | Device is rooted : true
| I | IntentService[Control Service] | SelectiveWipeUtils | Selective wipe for reason : PERSONA_OOC