yashsingh1/xdaforums huggingface dataset:
[Magisk] pndwal:
Shame... Could be some associated data messed up now also... Guessing clean flash would fix it or at least clean fastboot ROM flash then LOS flash...

There may be other ways but I don't know... - Any others here have ideas on how to avoid factory reset?

😶 PW
[Magisk] HippoMan:
The Google tools I'm referring to are their SafetyNet and Key Attestation API's. Perhaps you prefer not to refer to these as "tools", and if so, I'm fine with that. But whatever term is used to characterize them, these are the Google-supplied items that I referred to and which are being used by Devs.

And yes, I know that other root-and-mod-finding "tools" (or whatever term you prefer) are also being used by many Devs.

It actually seems that in most areas, you and I are saying much the same things about this topic.

And I also don't believe that the "cat and mouse game" has been lost by the mice yet. However, I do feel rather pessimistic about the chances of the mice ultimately winning, and perhaps I'm more pessimistic about this than you are.

And thank you very much for taking the time and making the effort to add that final parenthetical statement.
[Magisk] pndwal:
Sorry... Since you said:

I assumed you meant their custom tools / methods... Because actually these are the tricky ones to thwart! - Google's attestations, at least those used by banks etc to date, are really dead easy to thwart!... This is the essence of what I'm saying... Google didn't need to make it so easy!

If I state something related, please don't take it as meaning that I believe you think the opposite... I know you know this... And that you weren't born yesterday... 😛

Sure, mostly...

Except that I don't feel Google is driving this push for reliable attestation to secure device states, rather that they appear to be dragging the chain while doing just enough to supply what is demanded by the Android dev base and to be ready for a move to strongIntegrity while making such a shift a (tough) choice for the devs...

Gotta ask why they've done things this way, but ultimately it seems clear to me that app Devs with such security concerns will drive the change to the PI attestation that isn't dead easy to thwart, ie strong integrity (while Google could well have made this the no-brainer that it isn't).

The appetite for these security attestations is in part fed by the existence of a far more secure mobile OS that directly competes as an operating environment for the same apps...

Of course this OS precludes the practical modding possibilities we enjoy, and it's a tough job for Google to juggle these two valued and demanded OS features... The opposition's model is very different; they're only juggling one...

Quite...

Did I say I wasn't pessimistic?...

I am optimistic about the time we have left, but I've said several times that the time will surely arrive when banks determine that the collateral damage among customers will be low enough to swing the strongIntegrity hammer... After all the only stock device users it'll only shut out the tightwads hanging on to pre A8 devices and a few with junk like OnePlus, RealMe etc right? ('Do we need these customers anyway boss?') 😜😝

... I also said recently that this will spell Game Over for the mouse/mice, so I'm no less "pessimistic about the chances of the mice ultimately winning" than you are...

No worries... You're quite a sparing partner so far but wanted to be clear you're not in the 'bashing or making veiled insinuations' basket. 😉 PW
[Magisk] HippoMan:
Thank you for your further clarifications which confirm that you and I do indeed see things similarly concerning this issue.

The question of whether it's Google or Devs who are primarily driving the push for "strong integrity" is irrelevant to me. I couldn't care less about the answer to that question nor even about that question itself.

My point is simply that I believe that the mice will indeed lose this rooting-and-modding game in the ways we have been discussing, snd it's just a matter of time.

For me personally, the "upgrade to the latest Android and Magisk versions" game has already been lost. I'm still on Android 10 and Magisk 23.0 because I can still easily hide rooted apps and pass SafetyNet, and I can still easily use TWRP to perform nandroid backups and restores of System and Vendor and Boot, as well as Data.

And by "easily", I mean without having to jump through the crazy, convoluted, overly complex, bootloop-prone hoops we now have to deal with when trying to hide root under later versions of Android and Magisk.

But I know that even my halcyon days of Android-10-and-Magisk-23.0-and-nandroid-backup-restore enjoyment will be coming to an end sooner rather than later.
[Magisk] pndwal:
It's very relevant in relation to why we're still in the game however as well as how long it will go on...

AFAICS, if Google were driving this / intent on killing ability to pass attestations w/ root / the enemy as so many seem to think, they would/could have easily ended the game for all but a few unlocked device users long ago. (A simple HKA to device model along with either S/N or PI anti-abuse API attestation to device integrity could have ensured this as stated.)

The apparent reticence of Google to do this also goes to the matter of when the game will end and on what basis a decision will be made to switch to strongIntegrity attestation for anyone interested in how long we might have left... To me, understanding how Google have managed to shift responsibility for the decision to enforce HKA to the banks and also made it an onerous one by ensuring that it will impact at least some customers because of its very design is encouraging...

Most of us, including John, originally thought Google would simply switch it on when ready...

www.twitter.com/topjohnwu/status/1237656705850212352

Instead, it seems to me we're still playing the game largely because Google has found a way simply to create the switch and then say to bank Devs etc "here it is; you flip it... If you dare!"

Thats been a given since March 2020... And the means had already been 3+ years in the making by then!

It's been like convoluted game of chess already, but it will end in a check-mate, not a draw...

...But here you are talking bank's custom detections surely!... Google API use has been as simple as applying USNF for most, and swapping this more recently for @Displax's modded version...

But we've been on borrowed time for some years already and it now seems the game of cat an mouse may continue for a long while yet for the reasons I've been at pains to clarify; it may well be over later rather than sooner!...

And this is because the question of who's driving the push for HKA enforcement is actually pivotal; We've been so wrapped up in the game of Cat and Mouse that we've failed to account for the game of Truth or Dare going on in the background... It's the endgame that's of equal importance, arguably more, to the question of the imminence of 'Game Over'. 🙃 PW
[Magisk] HippoMan:
I'm not talking about anything related to banking apps. I have a suitable workaround for my banking app under Android, and I hardly do any Android-based banking, anyway.

What am talking about is how difficult it is to get Magisk and the necessary root-and-mod-hiding utilities up and running properly and effectively without dizziness, headaches, and bootloops on versions 11, 12, and probably 13 of Android on many (most? all?) phones. Of course it's possible, but it's much more complicated and easier to screw up than it has been in my Android-10/Magisk-23.0 world.

On my device, it used to take me less than 60 minutes to upgrade to newer versions of Android 9.x and 10.x (and less than 30 minutes if you don't count software downloading time and the duration of the prelimimary TWRP nandroid backup of Boot, System, Vendor, and Data). This included full rooting and full root-hiding Magisk configuration. No headaches. No complications. No bootloops. No multiple re-flashes. No trying and retrying different versions of root-and-mod-hiding-software which often require slightly different flashing procedures. And if I later changed my mind about the upgrade, I could very quickly restore the entire old OS from the nandroid backup.

I don't see any value nor importance in any post-Android-10 and post-Magisk-23.0 features, so I'm happy to stay in my current world.

You are indeed more optimistic (or at least less pessimistic) about this than I am.

Anyway, I hope that my pessimism is unfounded and that your lower-level of pessimism is more in line with what will actually occur. I'd be very happy to be proven wrong about this.

But I won't bet on it.
[Magisk] pndwal:
Latest Canary:

Magisk (c3b4678f) (25204)​

Make hiding the Magisk app 100% offline

Cleanups and minor refactoring of Zygisk

Diffs to v25.2​

[General] Fix minor bug in module files mounting implementation

[MagiskPolicy] Fix minor bug in command line argument parsing

[Zygisk] Prevent crashing daemon in error

[Zygisk] Rewrite zygote code injection with new loader library approach

https://github.com/topjohnwu/magisk-files/blob/2d09c7103c9c9a91813e467c725dcf613b4ef993/notes.md

👍 PW

*** Edit:

... So there's a fairly serious bug w/ Canary 25204... (breaks denylist and more)... May want to hold fire till Canyie's fix is merged... 🤪 PW
[Magisk] pndwal:
www.twitter.com/topjohnwu/status/1579695277778571266

👍 PW
[Magisk] noni2724:
i have magisk 23.0 installed already in my phone i want to update to magisk latest how to do tht? can i do it via magisk app?
[Magisk] noni2724:
when i try to install via magisk it gives error of "app not installed" while magisk is running.

i have 23.0,a/b no,ramdisk no, SAR Yes
[Magisk] dope77:
Uninstall the app then download the latest version from github
[Magisk] Regys:
HI,

After installing the 25.1, the version I have is Magisk c3b4678f is this normal ?
[Magisk] huskydg:
It's canary build
[Magisk] Regys:
Is it normal that the maj install the canary version ?
[Magisk] pndwal:
What device?... What Rom?... Can you open existing App? Are both App Installed and Magisk Installed showing 23.0, or other?... PW
[Magisk] pndwal:
No. - Not if you installed 25.1...

Yes if you installed 25204...

If you set Update Channel to Canary! 😛 PW
[Magisk] Regys:
Ah yes, is on Canary channel :D
[Magisk] pndwal:
... So there's a fairly serious bug w/ Canary 25204... (breaks denylist and more)... May want to hold fire till Canyie's fix is merged... 🤪 PW
[Magisk] kodein:
Magisk 25.204 canary does not pass the safety net test
[Magisk] rocketda7331:
this is to be expected with any version. there are modules to help with passing safetynet
[Magisk] devilsshadow:
You don't understand, the entire denylist functionality is broken on 25204, see @pndwal's post.

After downgrading to beta from canary all seems fine thankfully.

Funny story: i was on A12L, rooted

Decided to finally upgrade to A13. Updated magisk to latest canary, restored images, installed OTA.

Phone boots to A13 just fine with root intact but guess what, all atestation fails and none of my banking apps work.

Of course, I blamed the A13 OTA for breaking something. After hours of tinkering i realize it's just a bug in the latest canary build and there was nothing wrong with the magisk root restore/OTA.
[Magisk] V0latyle:
Same problem here with Canary 25204, all PI checks fail.

For some reason I can't downgrade to Beta 25.2. I've tried changing the update channel within Magisk, as well as uninstalling the Magisk app and re-installing the beta APK. When I do that, it installs as a stub and promps me to "download and install the full version", in which case it still reports the Magisk version as 25204.

What's the "right" way to downgrade from Canary to beta or stable?
[Magisk] rodken:
Were you able to review the discussion(s) laid out here?
[Magisk] V0latyle:
Yes, none of that helped.

I do not have Magisk hidden.

After updating to Canary 25204, I attempted to change the update channel in the app to Beta, then tap Install on the Manager section. App failed to install.

So, I downloaded the beta APK and attempted to install. It would not install with the Canary app installed. Removed Canary, and attempted to install Beta 25200; it then shows up as a generic icon, and when I attempt to launch, I get the message "Upgrade to full Magisk to finish the setup. Download and install?" When I tap OK and launch Magisk, it says the app version is still 25204.

At this point, the only thing I can think of trying to do is clear app data, perform complete uninstall, reboot, install the beta (or stable), reboot and boot a patched image for temp root.
[Magisk] zgfg:
I didn't update but I would think the issue should be in Magisk app, not Magisk itself

Hence you could try - leave updated Magisk app and flash the old IMG patched by your previous Magisk version (if you keep them)
[Magisk] V0latyle:
Yeah.

Is the "upgrade to full Magisk" message normal? I'm used to the app installing all at once, with a message after installation "Magisk needs to restart to complete setup" or something like that.

I've tried force stopping and clearing app data before uninstalling. Maybe I should do that, then reboot without Magisk installed, and attempt again...
[Magisk] zgfg:
That's because Magisk app was updated. You could try uninstalling the updated Magisk app, installing the older app version

Btw, I tested myself. With Canary 25204 SN and PI API fail, TB Checker finds SU

Issues with DenyList but other modules work fine

And when I flashed my old boot.img patched by 25203, everything works fine again - I left only the Magisk app 25204 and I don't bother that it reports Update for Magisk
[Magisk] V0latyle:
I thought that's what I was doing?

Force stop Magisk > clear data > uninstall

Install 25200 APK

Magisk shows generic icon, launch, message: "Upgrade to full Magisk...", tap OK

Launch Magisk when finished, app says 25204

Or are you saying that because I'm currently rooted with 25204, I need to reflash an older boot image?

Well, I was hoping to fix it before I got home...the plan was to just install an older version, then downgrade the Magisk patch via Direct Install. Is this not possible?
[Magisk] zgfg:
I did the following:

1) Uninstall but only the new Magisk app 25204 and install the previous (in my case Magisk 25203 Canary)

2) Flash the boot.img patched by that previous Magisk version - not sure if that is necessary, see the next step

3) Do Direct install (it will install the Magisk version based on your Magisk app from step 1)

Then, popup for full update and reboot went away for me
[Magisk] V0latyle:
Hmm. Maybe that's my problem, since the kernel is already patched with 25204, installing 25200 makes Magisk think it needs to update the app?
[Magisk] devilsshadow:
The only thing that got me out of the same situation you're reporting was to completely uninstall magisk, reboot, extract a clean boot.img, install magisk beta (or stable if you want), patch the boot img with magisk beta, go into fastboot and flash the patched boot img. Anything else I tried just made me go round in circles while stuck with the borked version (25204).

So for steps:

1. Completely uninstall magisk

2. Reboot

3. Install Magisk Beta or Stable (i installed via pixelflasher)

4. Extract a fresh boot img (i got it from the latest recovery image) and move it to phone storage

5. Fire up the Magisk app

6. Patch the boot img

7. Move patched boot img to PC

8. Fastboot flash boot patched boot img

9. Reboot

You should now be good with a downgraded magisk version.
[Magisk] V0latyle:
Okay. Your experience in addition to what @zgfg is saying, gives me the impression that my assumption is correct - if the Magisk app sees the kernel is patched by a newer version, it will force you to update the app to that same version.

It didn't used to be this way, and personally I don't like it much...I don't want to be forced to update because of cases like this. I should be able to install 25200, which should use the 25204 patch for root permissions so I can then re-patch.
[Magisk] Staniboy:
hi, have a qustions about installing on my galaxy note 9. lauchned with A8.1 but now updated to A10. the installation guide has a section for samsung but specifically with lauching firmware A9 or higher. which does not apply to my device, but the the standard section with boot.img and vbmeta.img and so on also does not apply. so what am i supposed to do?
[Magisk] pndwal:
That's basically the problem... It's this (in 25100+):

Force app version not lower than daemon

Nb. To downgrade app w/o uninstalling Magisk we can install Debug since daemon version check (and new signature check) are disabled in this...

After Direct install of Debug Magisk binaries, daemon version is no longer checked and any earlier App can be installed and Direct install used to install corresponding Magisk binaries...

👀 PW
[Magisk] zgfg:
I used Canary, not Debug, and there was no problem to install the previous 25203 app and then to Direct install that previous Magisk 25203

Btw, I never use Magisk Beta - I see no point in that.

For the long, long time, Beta is pushed only when Stable is pushed.

Hence either use Stable, or use Canary (or Debug only if logs are needed)
[Magisk] V0latyle:
I'm definitely glad we have someone like you around! Is "pndwal" Aussie for "wizard"?

Daemon is essentially the kernel patch?
[Magisk] pndwal:
Guys n gals:

Canyie's fix was just merged... (35 min)

Guessing new Canary any tick of the clock... PW
[Magisk] pndwal:
Latest Canary:

Magisk (a468fd94) (25205)​

Fix denylist

Diffs to v25.2​

[General] Fix minor bug in module files mounting implementation

[MagiskPolicy] Fix minor bug in command line argument parsing

[Zygisk] Prevent crashing daemon in error

[Zygisk] Rewrite zygote code injection with new loader library approach

https://github.com/topjohnwu/magisk-files/blob/14529ae5d3f39e3e9ac5e873eab5026c07653144/notes.md

👍 PW
[Magisk] pndwal:
Did you download Canary from main page or magisk-files repo?

I just tested again w/ 25.2 and 25202, and it's definitely still working like this... Full App just won't load...

Are you sure you didn't download apk.debug.apk from Canary branch in magisk-files repo?; That's actually Debug (simply built along with Canary so no separate branch needed)...

Canary Build is apk.release.apk. (Of course Canary is now built with release flags as announced)...

Sorry, did I mention Beta?...

However Beta builds often predate new Stable releases... John is often nervous about releasing first as Stable...

🙂 PW
[Magisk] pndwal:
😁... For me 'n my wife... 🙃

Nah... Magisk's background process, magiskd (first run at post-fs-data and accessed by magisk_client process.)...

https://topjohnwu.github.io/Magisk/details.html

🤠 PW
[Magisk] V0latyle:
Okay, so what do we call the kernel / boot image patch? I want to make sure I'm using the correct terminology here
[Magisk] zgfg:
I have Canary channel selected and that's the only way I always do updating - directly/automatically from the Magisk app

And when you update Magisk app, it automatically downloads Magisk APK to Download folder - hence I save it from there and keep it for some time

In parallel I manually patch the boot img from Magisk app, and also save my patched img to be easily able to revert if/when needed (I usually keep two or three pairs of the last versions of Magisk apks with my corresponding patched boot imgs)

Hence I never need to waste time to search on GitHub for an older version when the newest one turns to be a problematic one

---

OOPS - Sorry, I checked now and realized that I indeed had DEBUG channel selected (must be, I played some time ago, and didn't put it back to Canary)
[Magisk] zgfg:
Good one - DenyList working fine again
[Magisk] badabing2003:
In case it was not well known, there is a little button in PF that brings up Magisk download / install dialog

It will always point to the latest versions posted you can choose one of the 4 available builds.
[Magisk] pndwal:
Sorry: I thought we were talking about downgrading; don't you need to manually download for that?... Otherwise I guess you must have had a debug build archived from a previous install...

Accounts for previous downloads via the app/channel set, but I think most users have simply downloaded correct release builds so are affected... PW
[Magisk] pndwal:
Magisk-patched boot image... Nb. This applies to patched recovery.img (for A-only legacy SAR devices) since recovery.img is a boot image also...

Nb Magisk is installed in ramdisk, not kernel... A compatible boot image contains both...

What do you call a one-eyed Colonel in a boot camp who's lost his patch?... And would you like to meet him?

Answ 1 & 2:

Woodeneye SIR!

😁 PW
[Magisk] V0latyle:
I don't know what NB means lol

The SELinux patch is also in ramdisk? So Magisk essentially "hooks" the boot process to gain su access? Or Magisk directly patches /system/sepolicy?

In my experience, you generally don't speak to colonels except for a proper greeting, or unless spoken to :D

I've never had the displeasure of having to stand in front a full bird. Just a LtCol, who wasn't particularly happy about the 3 weeks worth of stubble on my face even though that particular day was my EAS...
[Magisk] HippoMan:
"NB" is another one of those Latin abbreviations like "PS" and "RIP".

It stands for "Nota bene" which means "Note well", or "Take special note".
[Magisk] V0latyle:
All edjumacated and stuff
[Magisk] pndwal:
The abbreviation NB comes from the Latin phrase “nota bene,” which means “mark well.”

NB Definition & Meaning | Britannica Dictionary​

Edit: see you've got this already. 😛

Done at boot-time:

Magisk Booting Process​

Pre-Init​

magiskinit will replace init as the first program to run.

...

On devices using monolithic policy, load sepolicy from /sepolicy; otherwise we hijack nodes in selinuxfs with FIFO, set LD_PRELOAD to hook security_load_policy and assist hijacking on 2SI devices, and start a daemon to wait until init tries to load sepolicy.

Patch sepolicy rules. If we are using “hijack” method, load patched sepolicy into kernel, unblock init and exit daemon...

https://topjohnwu.github.io/Magisk/details.html#magisk-booting-process

Detail on the policies:

https://topjohnwu.github.io/Magisk/details.html#selinux-policies

Wow... But you call 'im wodden-eye be'ind 'is back! 😜

I didn't know that one, but now I understand!...

Good thing you were Essential Air Service or you might 'a gotten a floggin... Or were you Expelling Air Silently during an Emergency Alert System activation while experimenting with Electric Air Suspension in an attempt to achieve the Equivalent Air Speed of the Earth Alliance Ship in Babylon 5?... Or just joined Essential Auxiliary Support for the Epilepsy Association of Scotland?...

I'd better stop before I activate the Eolin Antispam Service... 🙁 PW
[Magisk] HippoMan:
Unlike most of the rest of us, you've long been the awardee of a special Enable All Spamming dispensation here.
[Magisk] pndwal:
And what does that make you?... A silent protagonist?... 😝

...Expels Air Silently...

... This'll be my first post in a long while that isn't Magisk related...

Except that I just related it to Magisk didn't I?

... Nah... Sorry 'bout dat! 🙄 PW
[Magisk] m0han:
Not sure if I am getting this right, but...

Spoiler content hidden.
[Magisk] zgfg:
This is not Delta thread and I'm talking about official Canary 25205

For Delta please discuss in its own thread - btw, in Delta you likely use MagiskHide, not DenyList
[Magisk] HippoMan:
That wasn't a criticism. You are prolific at offering excellent insights and you are deeply knowledgeable, and you've been the mainstay of helpfulness here. Probably more people in this forum have benefitted from what you offer here than from anyone else's contributions.

For those reasons, I believe that the mods tend to give you a well-deserved pass for any OT posts of yours.
[Magisk] m0han:
Of course, that's why I put them under the spoiler. And, no I don't use MagiskHide or Zygisk (both are disabled). But, since this Delta is synchronised with official magisk, I am not sure it does not merit discussion - maybe not here.