yashsingh1/xdaforums huggingface dataset:
[Xposed Framework Modules] digitalhigh:
Yes, you read that correctly.

unWatch is a module designed to allow power android users to have root/xposed/insecure bootloader on their devices without indicating to AW servers that this is going on.

Before:

After:

This module has been tested on the HTC One M8 on both GPE and Sense ROMS.

Usage:

1. Install.

2. Activate in Xposed.

3. Reboot.

That's it. Once you've rebooted, you should be able to install the AW client on your device with no other issues. Your device will not report that it has been rooted or "compromised" and you can do whatever the heck you want with your device.

Note:

The intent of this app is NOT to circumvent security policies that may be in place by whomever is making you use AW. Aside from enabling root-features, it does not circumvent any other features of the suite. PIN, launcher, email, power, etc. restrictions should still be in place.

Additionally, as the module fakes AW out to only install packages for a "generic" device, it is possible that further development will be needed for scenarios where, say, a profile is assigned ONLY to a specific manufacturer's device.

Again, the main goal of this is in scenarios where YOU own the device, but work is forcing you to use their software.

Download here

Donations greatly appreciated...but not required. ;)​
[Xposed Framework Modules] digitalhigh:
Reserved.
[Xposed Framework Modules] Captain_Throwback:
I'm Captain_Throwback, and I approve this thread :)

Also, this module works well for me on my M8, on both Sense & GPE ;).
[Xposed Framework Modules] digitalhigh:
Approve? Didn't you inspire the danged thread? :P
[Xposed Framework Modules] dedei:
Would this allow knox 0x1 devices to use Samsung Pay?
[Xposed Framework Modules] digitalhigh:
I'm not sure...it is developed specifically for people who have to use the Airwatch MDM software...
[Xposed Framework Modules] milojoseph:
Can you make it or create an app to make it universal to spoof apps to think the phone is an original phone with stock bootloader framework and rom?

Sent from my SM-G900T powered by AllianceROM

and boosted by speedy kernel

Lollipop ?
[Xposed Framework Modules] Danktified:
Works on LG G4 VS986 Rooted

Works fine for me. Great job Digitalhigh! Take that oppressive Corporate Overlords!

*Shakes fist in the air*
[Xposed Framework Modules] digitalhigh:
Unfortunately, no, it doesn't work like that. There are many different ways one can tell if a device is compromised, and probably no one way to account for all of them without inadvertently breaking other things that *need* root/insecure boot image.

This module Is made specifically to deal with the way AirWatch is doing these checks...which is pretty poorly, TBH. I'm not doing anything with the ROM itself.

I believe what you're describing is more or less the module "RootCloak", which is a behemoth of an undertaking compared to what this does.

On what device? :D
[Xposed Framework Modules] Danktified:
See title of last post. :P

LG G4 Verizon

VS98611A

Android 5.1
[Xposed Framework Modules] digitalhigh:
LOLOL!!

God, I need to learn to read...
[Xposed Framework Modules] motoridersd:
SH*T! I need to try this on my Tmo G4. I haven't rooted because of Airwatch and I am getting annoyed with the LG things I can't disable without root.

Thanks OP!!
[Xposed Framework Modules] crunchybutternut:
Lg g3 - vs985

Tested with AirWatch Container, and was blocked due to not being compliant.

Going to try AirWatch Agent now.

EDIT:

Confirmed that this works with AirWatch Agent.
[Xposed Framework Modules] Captain_Throwback:
I've never had to use AirWatch Container. I'm sure that if you get a logcat of the compliance failure [MENTION=3400685]digitalhigh[/MENTION] can add support to the app.
[Xposed Framework Modules] digitalhigh:
Yes, if you get me the log and a copy of the container apk, I'd be glad to help.
[Xposed Framework Modules] BlindWanderer:
Won't install on my s5 kitkat 4.4.4
[Xposed Framework Modules] digitalhigh:
Could you grab an Xposed log so I can find out why?

What version of the Xposed framework do you have installed?
[Xposed Framework Modules] CableGuy77:
Great work!

Thank you very much!! This is exactly what I've been trying to accomplish, and you spanked it!! Thanks again DigitalHigh!!
[Xposed Framework Modules] manbat:
APK will not download correctly for me. From browsers or from the xposed app.

Sent from my SM-N910V / VZW Note 4 DE / Factory Bootloader Unlocked / Rooted / Custom Kernel-ed/ TWRP 2.8.7.0.trltevzw
[Xposed Framework Modules] motoridersd:
I just spent a few hours rooting, xposing and airwatching my G4. Thank you so much OP! You have ridden me from the shackles of my IT department and I will be forever grateful.
[Xposed Framework Modules] bmac6996:
Apkpure. Using inbox 2.4.0.19
[Xposed Framework Modules] pankajvg:
can you please give me link of old agent (Using old agent - version 5.3)
[Xposed Framework Modules] Captain_Throwback:
Not to hijack [MENTION=3400685]digitalhigh[/MENTION]'s thread, but using Magisk Manager to toggle off root seems to allow Airwatch Agent to authenticate and show the device as compliant without the need of the unWatch module. For my needs, that works as once the Device Administrator is active, is doesn't bother checking for root again (though I have noticed a root prompt coming from Airwatch Agent, which I immediately denied). I'm not sure if that'll work for everyone, but it may be worth a try.
[Xposed Framework Modules] sids77p:
Thanks for the info. :) Queries: does the latest versions of Inbox and Agent work with this method? Corporate ask to use the latest versions. :( Also what exactly is Magisk Manager? Any apk/link would help. Thanks.
[Xposed Framework Modules] Captain_Throwback:
I'm using the latest versions, and a search should net you results for your other question ;).
[Xposed Framework Modules] Jinded:
I tried using Magisk to unroot then install Airwatch Agent, but Agent still shows my device as noncompliant/rooted. Are there any other steps you took to get this to work? Are you running systemless Xposed?
[Xposed Framework Modules] Captain_Throwback:
Try rebooting the device and immediately disabling root in Magisk Manager when the device is available. There's usually some time period involved for all of the root processes to completely stop, so disabling it right after boot eliminates this issue.
[Xposed Framework Modules] mr_billionaire:
Ahhhh! This would work wonders on my work Nexus 5X if they didn't block Dev Options :( can't even adb push the Nougat OTA
[Xposed Framework Modules] Jinded:
I tried this (confirmed working since SuperUser asked to install su binaries), but still no luck :/ Maybe Agent still detects Xposed or some other rooted capability.
[Xposed Framework Modules] Captain_Throwback:
Are you using systemless Xposed? I have Xposed currently disabled, but even when I had it enabled, the Agent showed my device as compliant. I just opened the Agent now after toggling off root, and it shows as compliant. So I'm not sure why it's not working for you.

If you're using standard Xposed, then it makes sense that the Agent would be showing as compromised/non-compliant.
[Xposed Framework Modules] Jinded:
That's strange. Yes I'm using Magisk v6, phh SU v17, systemless Xposed 86.5, and systemless Viper4Android. Android Pay works fine when I disable root but Agent always detects it for some reason.
[Xposed Framework Modules] bmac6996:
Generally Airwatch checks at least once a week to see if your device is still complaint. I don't know if that's a policy set by everyone's individual company or Airwatch own doing.

I feel like Airwatch does check for root for sure, and possibly an unlocked bootloader and depending on your phone and stock or non-stock rom check that as well.
[Xposed Framework Modules] SHPhone:
I don't know if Airwatch looks for the same things for every company that uses the service, but I can confirm that an unlocked bootloader does NOT cause a problem for me. My company has been using Airwatch for 2 years now. I've had both my Nexus 5 and 6p unlocked without a problem.

Stranger still, I never had a problem with the phone being rooted when I was running Cataclysm ROM on my N5. Root did become an issue within the past year. But, the latest version of Cataclysm that I was running on my 6p was really Mod that ran over the top of Stock MM and didn't require root. So my Nexus 6p was unlocked, running a custom "ROM" (Mod), and custom recover with no problem at all. When I tried switching to PureNexus in April (when the dev for Cata abandoned the project), my phone was immediately flagged as non-compliant. So, I switched back to Cata. I tried again last week to run PureNexus (because it no longer installed SU by default). Still, Airwatch flagged it as non-compliant. That really confused me. So, I simply switched to stock Nougat (no Magisk, no root, no Xposed) and I'm fine. I want to try DigitalHigh's modified N Rom but want to be sure I won't run afoul of Airwatch.

I'll be following this closely. DigitalHigh suggested in response to something I posted on his ROM thread that he thinks the root toggle should work. I don't know if that means I wouldn't need Xposed (and the UnWatch module) or not.
[Xposed Framework Modules] Philux:
As an AirWatch admin I can confirm that you are correct. When a device enrolls into AirWatch, the Agent reaches out to AirWatch owned servers and relays the collected system information. This is the same procedure for all companies regardless of the profiles that are set. There are no options in the AirWatch console for allowing rooted devices. I was told from AW that legit rooted devices could be allowed, but it was something that AW had to do on their backend servers to allow the device. As for me, I am running CM13 with su binaries removed to pass compliance. My device has the bootloader unlocked, and that is not an issue. I am running CM13 which is considered modified firmware, and that is also not an issue. My devices passes all the compliance checks.

The things that I do not know, is how often the AirWatch agent checks the device for compliance after enrollment. The systemless Magisk method may work for a while, but I wonder how long until the AW Agent catches SU running in the background when an app is locked to it.
[Xposed Framework Modules] dcooterfrog:
on cm13 how didi oyu remove the binaries is that all you didi to be "compliant"
[Xposed Framework Modules] chhapil:
5.2 vs 6.2

Guys I analysed both the packages after decompiling them.

In 5.2 they were using ProGuard at the class level, now they are using it at method level in 6.2

I'm looking to update the current unWatch code but it looks like a daunting task to find the matching code from the obfuscated code and make the module work. I have limited time out of my professional life, so it would take me some time.

I suggest to use the old version till it can be fixed for the newer version.
[Xposed Framework Modules] Philux:
I removed the su binary from the image before flashing.

I haven't tried, but you may be able to remove the binary using TWRP File Manager.

/system/xbin/su

---------- Post added at 10:49 PM ---------- Previous post was at 10:34 PM ----------

Chainfire's new suhide mod looks pretty interesting. By default Google apps including SafetyNet is blacklisted to su. It basically hides su from SafetyNet. There is also a method to add other apps based on their UID. Essentially one could find the AW agent UID, and blacklist it to su.

[2016.08.29] suhide v0.01 [EXPERIMENTAL/UNSUPPORTED]

In theory this should work, but I have yet to try it myself.
[Xposed Framework Modules] sids77p:
Thanks, it will be of great help to us all :)
[Xposed Framework Modules] cheungke:
Corp seemed to have caught on to users remaining on old version. I just received a company email indicating detection of compromised device state. I'm still on air watch agent 5.3.2.790
[Xposed Framework Modules] drewski_1:
They're craftier than our IT. Still chugging on older version at my company . . .
[Xposed Framework Modules] cheungke:
I flashed nougat factory image today. Root checker shows no root. Passed safety net check. Uninstalled all xposed installer and modules, greenify, amplify, busy box, everything that may trigger compromise. I even updated mdm, inbox and content locker to latest version, but Mdm agent still shows my device as compromised...... Fml
[Xposed Framework Modules] sansnil:
Not sure what you're after here...

1. unWatch is an Xposed module

2. There is not yet Xposed for Nougat

3. You are running Nougat

4. Return to 1
[Xposed Framework Modules] cheungke:
Just sharing my experience, continuation from previous page...

My primary objective for root was to mod dpi, didn't care much for xposed though it was a plus. Now that Nougat offers native dpi adjustment, no longer a need to root from my POV.. And can benefit from the Pay's.
[Xposed Framework Modules] JuergenZ66:
another option to remove root is to use unSU, just flash it in recovery
[Xposed Framework Modules] sids77p:
Just tried using AW 5.x on AOSP N without root. Bootloader unlocked. Even with ROM without root, AW flags as non-compliant. So, definitely it checks for non stock ROM as well. Same with CM13 i tried. So, for now sticking to previous AW, Unwatch on CM13. Until we have xposed for N, cannot upgrade to android N :( since i guess Unwatch is the *only* key we have to continue using AW on rooted, non-stock ROM.
[Xposed Framework Modules] dazhdbog:
i tried to pass compliance with unmodified freshly flashed cm12, and it was found to be "compromised".

next, i reflashed cm12 again and removed /system/xbin/su and /system/bin/su from the device using adb shell, rebooted and tried to enroll with airwatch agent again, but the device was still found to be "compromised".

Maybe once a device is found to be "compromised", its serial number is saved on airwatch backend and subsequent attempts to pass compliance with this device are useless,

contrary to promises to lift restrictions after the device "becomes compliant"?
[Xposed Framework Modules] Captain_Throwback:
No.
[Xposed Framework Modules] drewski_1:
I've shifted from non-compliant to compliant on several devices. Not sure if Custom ROMs are considered compromised by default?
[Xposed Framework Modules] sagiporat:
Help?

Hey man,

Do you remember what you were doing? I have the same model, and still experiencing issues - can't install 'xposed'.
[Xposed Framework Modules] Golubev:
Since that old post there are many Agent updates, so UnWatch not working for me now(( So i have to use SuHide 0.55 instead, it works great with Agent to hide Root presence.

http://xdaforums.com/apps/supersu/suhide-t3450396
[Xposed Framework Modules] sagiporat:
Thanks...

Thanks - will give it a try.
[Xposed Framework Modules] Captain_Throwback:
Magisk also works.
[Xposed Framework Modules] enchanterchi:
It doesn't work for me. Would you please share some details?

Such as which ROM are you using and how to make magisk working?

Thanks
[Xposed Framework Modules] walletless:
Both suhide & magisk will only hide su, but not the custom/modified ROM. So aw agent will still find the device status as compromised.
[Xposed Framework Modules] Captain_Throwback:
Magisk will hide an unlocked bootloader. I use Magisk with Airwatch Agent just fine. Just search the Magisk Discussion thread to see how.
[Xposed Framework Modules] kawasaks:
to get airwatch working, do you also need to install/setup suhide?

my assumption is

magdisk -> hide unlock bootloader so Airwatch app is launchable

suhide -> hide root so Airwatch will think it is compromised

so need both?
[Xposed Framework Modules] BazmanFoo:
Ive managed to get the app to launch and enroll but its seeing my device as compromised so cant get mails etc. What am i missing?
[Xposed Framework Modules] Captain_Throwback:
Did you enable Magisk Hide?
[Xposed Framework Modules] BazmanFoo:
I have hidden Inbox, Agent & Settings.

I unenrolled and reenrolled and mail now working, althpugh device still showijg as compromised. Is that your experience too?
[Xposed Framework Modules] Captain_Throwback:
No, device doesn't show as compromised for me. But everyone's corporate policies are different, so yours might be more strict. Or the ROM you're using may have some feature that's tripping Agent that mine doesn't.
[Xposed Framework Modules] BazmanFoo:
Well as long as its functioning im pretty happy, thanks.

Annoying that it seems the mail and calendar cant integrate with the native android system and need to be in these terrible airwatch apps only but again that may be down to my companies policies.
[Xposed Framework Modules] Captain_Throwback:
That's definitely a company policy. I'm suffering with those apps for the same reason.
[Xposed Framework Modules] dajiu:
Hi,

I have both Magisk Manager and Systemless Xposed installed on my HTC 10. Strangely enough, Airwatch Agent can run even if I don't have SuperSU checked in Magisk Hide. However, if I have Xposed Framework running, Airwatch Agent crashes. I've tried it with unWatch running, with no luck. The only time I can get the agent to start up properly is if I disable Xposed Framework. Did I do something incorrectly to set this up?

Thanks in advance.
[Xposed Framework Modules] Captain_Throwback:
Magisk doesn't hide Xposed.
[Xposed Framework Modules] dajiu:
Ah ok. So it sounds like there's no way to get AirWatch to run while having Xposed as well.
[Xposed Framework Modules] walletless:
So I read the magisk thread and am a bit confused on how to start from my devices current state. My Nexus 6 is currently rooted using system (not systemless) method. If I understand correctly, this is not supported with magisk. So the steps I need to follow are:

1) re-flash the latest official Nexus6 (Shamu) image (nougat)

2) lock bootloader

3) install latest magisk manager

4) install magisk, install phh root, enable magisk hide

5) reboot, and then select AirWatch agent & settings from magisk hide

6) reboot again & done

Is my understanding of the steps correct?
[Xposed Framework Modules] Captain_Throwback:
Why would you lock your bootloader? Don't do that...

The rest of your steps seem fine, except you missed installing TWRP in the place of "lock bootloader". Also you have to install the phh Superuser app - I'd recommend the Beta APK by [MENTION=5444464]PunchUp[/MENTION] posted near the end of the Superuser thread.
[Xposed Framework Modules] walletless:
Installed Magisk + phh's, enabled Magisk hide, added AirWatch agent & settings to it.. but agent shows device as compromised :(

Am I missing something?
[Xposed Framework Modules] hsiehboss:
Same problem here, my company use airwatch to lock the phone camera.

although device as compromised but the function is normal.

I apologize for my poor English.
[Xposed Framework Modules] wyt18:
trying to find a solution for airwatch and custom roms w/ root too, can you share your experience?

i tried installing magisk on a CM13 based Mokee rom: dirty flashed rom, unzipped rom to flash boot.img via twrp, then flashed magisk zip and phh superuser zip. reboot, root is gone. installed magisk manager 2.5, 3 green ticks, but attempts to select 'magisk hide' leads to force close of magisk. also unable to install any magisk modules

airwatch agent does not even start, force closes upon any attempt at launch. i tried the 5.2 version too, same force close problem. since root is gone, xposed not installed, airwatch must be force closing on bootloader open detection?

any ideas? thanks!

note: ive also tried the various xposed modules with the 5.2 agent version, eg rootcloak, unwatch ... agent basically force closes without being able to enter even the first activity
[Xposed Framework Modules] Captain_Throwback:
CM13 has root built in, so you have to remove that before installing Magisk-based root.

P.S. And you can't have Xposed installed and use AirWatch.
[Xposed Framework Modules] wyt18:
thanks! figured out where I went wrong, i had to install the phh superuser app from the play store which didn't force close on my like the beta from the xda thread did. so right now airwatch opens normally, though i'm getting a "invalid user credential" error which may be due to my account being configured wrongly on corp's server side

bummer that airwatch wont work with xposed. if one had xposed installed, where does the error normally occur? would "invalid user credential" when trying to enrol be a symptom? or would airwatch work normally just showing the device as compromised? would be helpful to know where xposed normally trips up airwatch so i know if its traces of xposed (even though i removed the framework airwatch might still be detecting it?) or something else that is tripping airwatch up
[Xposed Framework Modules] Captain_Throwback:
If Xposed is installed and enabled, AirWatch won't even open. It just crashes.
[Xposed Framework Modules] kawasaks:
any way to get airwatch agent to launch with xposed framework?
[Xposed Framework Modules] wyt18:
Not sure why, but latest version of airwatch from play store worked for me even though i have xposed

Device shows as compromised, and fails safety net check, but inbox airwatch working fine for now
[Xposed Framework Modules] Captain_Throwback:
Interesting. Were you already enrolled, though? Once enrolled, the device appears to stay that way. But you wouldn't be able to enroll with Xposed enabled. You have it enabled?
[Xposed Framework Modules] wyt18:
i actually enrolled while having xposed enabled. first time using airwatch, setup was magisk 9 + phh (didn't use unwatch at all). i did see that airwatch forced closed when i used the older Agent v5.2, but after upgrading via google play it stopped force closing and allowed me to enroll. now i updated to magisk 10.2 and while it shows safety net failure, it still allows me to sync

i think it's because although my device shows as compromised, it is still compliant. maybe it's diff corp policy. we'll see how long it lasts :)
[Xposed Framework Modules] kawasaks:
really? not only Airwatch agent launches with Xposed but also works if Airwatch agent is enrolled before Xposed is installed?
[Xposed Framework Modules] hsiehboss:
naugot 7.1 magisk 10.2 roothide

我從使用 Tapatalk 的 Nexus 6P 發送
[Xposed Framework Modules] morfinrider:
Can you please share how you did this? I want to move to LineageOS, but Agent keeps showing up as "Compromised" and I cannot connect to Corp network :(
[Xposed Framework Modules] theuchi:
is it possible to cheat airwatch to not encrypt the android device?
[Xposed Framework Modules] hsiehboss:
My phone is nexus 6p

1.flash purenexus 7.1.1

2.flash gapp

3.flash mgisk 10.2

4.flash phhs_SuperUser_topjohnwu_r2

Then use mgisk hide , airwatch work normal .

我從使用 Tapatalk 的 Nexus 6P 發送
[Xposed Framework Modules] white_demon:
I have v 4.4.3. I get a message saying it cannot be activated because it requires xposed64.

My kitkat goes only up to 54.

Suggestions?
[Xposed Framework Modules] Bojesse:
Quote:

Originally Posted by hsiehboss 

My phone is nexus 6p

1.flash purenexus 7.1.1

2.flash gapp

3.flash mgisk 10.2

4.flash phhs_SuperUser_topjohnwu_r2

Then use mgisk hide , airwatch work normal .

I have a Pixel xl with the pure Rom 7.1.1

Can you confirm that it also works?
[Xposed Framework Modules] drewski_1:
Try it and report back
[Xposed Framework Modules] Captain_Throwback:
Pixel isn't supported by Magisk.
[Xposed Framework Modules] Bojesse:
Quote:

Originally Posted by Captain_Throwback 

Pixel isn't supported by Magisk.

What possibilities I have with my pixel to run the Airwatch app? Does Xposed works with 7.1.1?