yashsingh1/xdaforums huggingface dataset:
[Magisk] pndwal:
Guess you mean MagiskHide is running (w/ root hidden from bank app)...

But this does help us understand why big corporate G is eager to play catch-up with iPhone w/ respect to security / Hardware key implementation, etc:

Their security model (SafetyNet API, etc) has been / is so NOTORIOUSLY easy to circumvent that corporate players are actually BANNING Android phones and issuing iPhones to employees, etc, etc.

Banks are FORCED to find alternatives to SafetyNet because it's SO EASY to get around, just to offer their services on Google's platform. And I'm sure they are aware of threads like this one...

I'm equally sure Google's Shawn Willden and his team are watching too... I can see him muttering "What to do? Whaaat to do?"

And so we have a VICIOUS circle. Customers demanding more security and banks paying out losses to fraud, Android OEMs loosing market share, banks boycotting Google's SafetyNet API and establishing custom Security models, and expendable Google executives juggling high stakes options...

What would you do in Shawn's shoes? ... Sit on your hands? Whaaat to do?

It surprises me that John Wu's prediction that MagiskHide will only be good for hiding anything in userspace (no longer being capable of spoofing bootloader/verified boot status), ie for hiding "root" but not the bootloader status, has not eventuated ALREADY!

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-82211559

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-82941997

Nb. When banks tell you 'Your device is rooted' they are often really saying "a modified environment that may violate our security model has been detected, so we choose to prevent our code from executing as our security model has been breached". Ie, "root" is often not the identified flag; unlocked bootloader or another 'unsecure' element is often the real culprit.

Great tip! PW
[Magisk] Drake008:
Found it. Thanks.

But the app still says its rooted
[Magisk] Didgeridoohan:
And that's why I linked you to my guide and tips on how to hide root from an app in a previous post:

https://www.didgeridoohan.com/magisk/MagiskHide#hn_Hiding_root_from_apps

But, there are apps that you'll likely not be able to hide from at the moment. Once John gets zygote injection working that should be a thing of the past though... Of course, there's no ETA on that.
[Magisk] Drake008:
Ah. OK. Thanks for the link I will read it thourogly
[Magisk] HippoMan:
It also helps us understand how silly and out of touch with reality the IT and Security managers at some of these banks are. We all can get full access to their banking software on our rooted desktop machines, and they are not getting all worked up concerning security about that. Thousands, if not millions of desktop machines have been hacked, and it's no more difficult to do that than it is get into a rooted Android device if it is stolen or hacked into.

Even if some day Google's app environment becomes as impenetrable as Apple's, we will still have the option of accessing those banking web sites with full capabilities via a browser on our devices, be they rooted or not.

The only way for the banks to solve this problem would be for web access to their banking sites to also be restricted on devices that are rooted (which would include all desktop machines).

And even if Google ever starts monitoring web traffic and blocking direct web access to certain banking sites from Android devices, those sites could still easily be accessed via Android browsers by means of a proxy front-end web application that simply routes to the bank's actual site. I could probably write something like that myself, and I'm no John Wu.

Bank security people should be spending their time on projects that will actually help their business' security, instead of this useless and person-hour-wasting effort (both for bank IT developers and mobile app users) which accomplishes little. But they won't change their ways, and this silliness will continue.
[Magisk] pndwal:
Mate, don't get me wrong; I didn't say I like it (and may like it less than you!) And I could wish it were that way too...

Guess the IT contractors for McDonald's could be fixing the soft servers too!...

But maybe their using SafetyNet API might benefit my waistline once they customise security for Macca's app too, or when the big G does the big M an inevitable favour. 😁 PW
[Magisk] trynex:
Just my recent experience about non-working banking app:

When I updated my phone to a newer update of LineageOS 17.1, my banking app started detecting issue. I had installed Magisk again earlier, but forgot to hide it. Once that is done, I rebooted my phone (may not be necessary though). The banking app then worked fine.
[Magisk] pjb9:
Hi All,

I have installed Lineageos 17.1 and Magisk 22.0

SafetyCheck is still failing. BasicIntegrity has a tick against it., but ctsProfile has a cross (evalType is BASIC).

When I installed Magisk, I had to do it from TWRP as a zip as the device wouldn't boot into fastboot. I have Magiskhide enabled. I installed the Smali patcher and Universal Safetynet fix from Magisk.

Device is a Samsung Note 5.

Versions installed:

* Magisk 22.0

* Smali Patcher V0.0.7.3

* Universal SafetyNet Fix V1.1.1

I've installed Rootbeer and after hiding the app everything is green except for the "Root Management Apps" which has a cross against it and the word "ROOTED" on the screen.

I've tried toggling Magiskhide on and off and rebooting but that's not working.

I've also tried flashing the magisk boot.img via TWRP but that has made no difference.

Any help or tips would be awesome.
[Magisk] ineedroot69:
it has todo with smali patcher ...
[Magisk] HippoMan:
My point is simply to suggest that we not use those particular banking apps which go beyond SafetyNet, and instead, to get full, unrestricted banking capabilities on our rooted devices via a browser going to the banks' web sites ... the same unrestricted banking capabilities we already get when accessing the bank via our rooted desktop computers.

The wasted efforts of the IT snd security people at the banks will then have no effects on us.
[Magisk] Didgeridoohan:
@pjb9 You probably also need to change the device fingerprint to one that is certified by Google. You can do that with MagiskHide Props Config, installable from the modules section of the Magisk app.

https://www.didgeridoohan.com/magisk/MagiskHide#hn_SafetyNet
[Magisk] pjb9:
Thanks for the help. I appreciate you taking the time to respond. I installed Props Config and rebooted.

I still have the same symptoms:

* The safety check says attestation failed with ctsProfile having a "-" against it.

* Rootbeer still has a red cross against "Root Management Apps" and has the word "Rooted" on the screen.

Is there anything else I can do or check?
[Magisk] Didgeridoohan:
Did you also set up the MagiskHide Props Config module with a certified fingerprint? Just installing it does nothing... Usage instructions in the docs:

https://github.com/Magisk-Modules-Repo/MagiskHidePropsConf/blob/master/README.md#usage

And RootBeer might be complaining about the Magisk app (but SafetyNet doesn't care about that), but that's very easy to fix by going to the app settings and repackage it with a random name.
[Magisk] ineedroot69:
install props config then goto playstore then download termux then open termux then type

su

props

then at this point your'e now on props config dashboard then just change your device fingerprint
[Magisk] pjb9:
@Didgeridoohan @ineedroot69

Thank you both so much for your help. Changing the fingerprint fixed my problems.
[Magisk] pndwal:
...and I thanked you post, + commented "great tip!" on the strength of that! It may very well be a lifesaver for some who can't get apps working. 👍

My point was simply to suggest that the conclusion that measures to 'do extra checks on the device beyond SafetyNet' are 'ridiculous' is highly subjective.

Many here in the custom modding community may hold that view, especially given perceived (I don't know much about browser security implementation / security add-ons / strong sandboxing, etc) anomalies such as browser based banking working even where SafetyNet fails, but MANY others will hold a different view:

Banks need to be seen to have alternatives to a patently flawed SafetyNet API, so going beyond that is not 'ridiculous' to them.

Google is getting a bad reputation, and Android devices risk loosing market share because of the same API, so there is pressure on Google to implement Hardware Keystore properly to make banks, OEMs, Corporate players with Security interests & concerns, and other customers happy.

Google executives like Shawn don't see the banking entities efforts as ridiculous either, but he and his Security department clearly have a vested interest in stemming this tide by finalising Hardware Keystore Attestation rollout when bad vendor Keystore implementations (OnePlus etc) etc are resolved.

This Hardware backed Attestation will actually be FAR worse for our 'small' modding community than banks doing extra checks on devices beyond SafetyNet, and it will no longer be an 'opportunistic' (Danny Lin's description) implementation that can be circumvented by any practical means... but it's coming. 🙁

And it's coming because rather than being ridiculous, the players who count regard it as the only answer. PW
[Magisk] HippoMan:
I made it clear more than once that I don't expect Google nor those banking people ro change their strategies. They believe in what they are doing and certainly don't consider themselves to be ridiculous.

But we still can circumvent their going-beyond-SafetyNet efforts via this browser-based method, and John Wu and others could still come up with more effective circumvention techniques over time.
[Magisk] mamba76:
Hi all. I seem to be missing /system/default.prop and Im sure I had it!! but only build.prop is in my system folder. Would Magisk have removed / hidden it?? I found prop.default in /system/etc folder (same folder contains init folder) and I can say the contents look like I remember. Should I copy this to /system folder or can I just apply mods to this one?
[Magisk] booneb50:
So this turned out to be a compatibility issue. It doesn't surprise me I know this is old hardware but it does what I need. I was able to install Magisk v22 using TWRP and Magisk v22 as a zip file and the. Apk file. Safetynet test fails, installing any modules fail. I haven't had any other problems, I have root so I'm good. Thanks for all the help.
[Magisk] HippoMan:
Then, we can move on to an even better rooting experience and let zygotes be zygotes :)

Something to look forward to.
[Magisk] djjohnnyblaze:
After applying the latest April 2021 update today, it appears that patching the new factory boot.img and flashing it results in a boot failure and kicks me back into fastboot with reason: No valid slot to boot. Flashing the original factory boot.img allows the OS to boot without any issues.

This wasnt an issue before the April 2021 update and I havent changed anything in my process. So wondering what may have changed to cause this.

I am unable to provide a logcat as the boot process does not seem to get far enough to allow adb to find the device.

Device: Google Pixel 3a Sargo

Android version: Android 11

Magisk version name: Canary

Magisk version code: 22006

I have opened a bug on github for the same but wondering if anyone else is having the same issues.

Thanks in advance!

EDIT: This process seems to work with latest Magisk stable. Canary has issue with patching boot.img but stable works FYI.
[Magisk] pndwal:
Yup, agreed. 👍

However, as to whether these new ways to hide root can constitute 'more effective circumvention techniques', this is subjective too.

As John has been at pains to point out, "there is literally no practical way" to hide bootloader unlock, (read 'pass ctsProfile') post Hardware Key Attestation.

Full HW attestation rollout will necessarily = Game Over for SafetyNet pass w/ root, AND the use of apps calling this API, UNLESS someone can figure out a way to re-lock bootloader after rooting; Another tall ask (/ pipedream?).

Hiding root in userspace may well improve, but spoofing bootloader/verified boot status will then be futile.

Anyone waiting for 'more effective circumvention techniques' shouldn't hold their breath. ☹️ ... I don't recommend hyperventilating either. PW
[Magisk] ineedroot69:
this is my system.img extracted with 7zip and there is no default.prop too
[Magisk] prot-:
April 2021 security update with latest root and safety net fix is working without a different kernel this month. On Google pixel 3xl. The last 3 months I've had to have a custom kernel for safety net to pass
[Magisk] stormy1777:
Any chance someone from Magisk side can shed any light on issues trying to upgrade to Magisk v22 on Redmi 7A, described here:

https://xdaforums.com/t/redmi-7a-upgrade-to-magisk-v22-issues.4257161/

Simply put, the device appears as ramdisk NO, as such docs indicate one needs to go through "recovery" boot, i.e. each time, boot through recovery to get magisk..

Tried all things (see that thread, patch boot.img or recovery.img), and no matter what, it did not work, I suspect the actual patching of the local file does not happen correctly... Any tips, ideas here or there, welcomed!

Stormy.
[Magisk] mamba76:
turns out this file /system/prop.default is symlinked to /system/etc/prop.default. Changes made here have the same effect. Just that I was sure I had this file in system root, looks like I was wrong
[Magisk] pndwal:
Latest Canary Changelog, including Release Notes:​

Magisk (9c0e1897) (22007)​

[General] Fix logic to copy sepolicy.rule during module installation

[resetprop] Always delete existing ro. props before updating. This will fix bootloops that could be caused by modifying device fingerprint properties.

Diffs to v22.0​

[App] Prevent multiple installation sessions running in parallel

[App] Prevent OutOfMemory crashes when checking boot signature on PXA boot images

[General] Proper cgroup migration implementation

[General] Rewrite log writer from scratch, should resolve any crashes and deadlock

[General] Many scripts updates fixing regressions

[MagiskHide] Prevent possible deadlock when signal arrives

[MagiskHide] Partial match process names if necessary

[MagiskBoot] Preserve and patch AVB 2.0 structures/headers in boot images

[MagiskBoot] Properly strip out data encryption flags

[MagiskBoot] Prevent possible integer overflow

[MagiskInit] Fix sepolicy.rule mounting strategy

[resetprop] Always delete existing ro. props before updating. This will fix bootloops that could be caused by modifying device fingerprint properties.

👍 PW
[Magisk] pndwal:
Wow, this is a breakthrough! ... With minds like @osm0sis on it, I may soon need to eat my hat! ... and I really hope so:

https://xdaforums.com/t/tools-zips-...tiple-devices-platforms.2239421/post-84764713

... Will the cat let the mouse get away?...

Better get an A/B device... and a smaller hat. PW
[Magisk] pndwal:
Canary 22007 fine for me using direct Install to update on RN8T.

Can also confirm merged SELinux fix also fixed ViPER4Android FX Neon driver Abnormal workaround (ie. with Legacy mode selected, Install then disable Audio Modification Library module to force Neon driver re-install, after which Neon Status = Normal, Mi phone sounds like a symphony and all is right again in the world...):

Post in thread 'Magisk General Support / Discussion' https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-84721535

👍 PW
[Magisk] mr-tical:
Hi,

I updated Android to latest April update and now I can't pass safety net.

Earlier I updated Magisk to latest v22, all worked fine.

Now after April update Safetynet failed, Google Pay not working.

Can you point me what should I check more?

Attached screens what I have, the same set worked before April.

Pixel 3a XL.

Thanks..
[Magisk] Paladin Gunny:
I'm on Android 7.1.2, RR-N 5.8.5 ONYX

Previous versions of magisk gave me the ability to use magisk-hide, even though I had to use "Magiskhide --disable Magiskhide --enable" on every reboot, I really didn't mind. Ive been using this workaround for a LOOOOONG time.

Yesterday I updated to the new version and now everything is broken, I can no longer use my banking app. Magiskhide is no longer working. What is the solution here? I'd LOVE to downgrade but I can't find the means to do so, not even on github. Please help.
[Magisk] mr-tical:
I installed https://xdaforums.com/t/magisk-module-universal-safetynet-fix-1-1-0.4217823/ and now CTS is good as well, Safety net is OK, but Google Pay is not working still and now phone is hanging, after OS boot, phone freez.

Help guys..

//edit: phones booted up finally, but Google Pay is still not working, CTS is good.

Any idea?
[Magisk] pndwal:
You now need USNF as you may now know.

You don't need MHPC if on stock ROM.

You don't need GPay SQLite Fix any longer.

Systemless Hosts can cause instability.

After triggering GPay error due to detection of modified environment, ensure PlayStore PlayProtect says Device is Certified (clearing PlayStore Data and Google Play Services cache should fix if not) and root is hidden from GPay by toggling GPay on in MagiskHide list. Also, toggle MagiskHide off then on again in settings, then reboot.

Next, reset GPay flags by clearing app data. You'll need to set up cards etc again. PW
[Magisk] pndwal:
There's a fix for that: create a late_start service boot script. See here:

https://www.didgeridoohan.com/magisk/MagiskHideIssues#

New public 22.0?

Sure MagiskHide is toggled on in Settings? Try toggling off, then on again.

Also, if you had Magisk Manager hidden/renamed, did you unhide BEFORE updating app as per instructions/reasons in changelog? If not, you'll have manager/app issues, and need to locate/uninstall BOTH before re-installing Magisk app.

You could try latest debug (Canary) build. It has many fixes. See differences in Release Notes I posted above.

Download apk file from main page Downloads / Magisk Canary link. (Clange extension to.zip to install from Custom Recovery)

Downgrading is easy w/ TWRP / zip package; just download and flash. Restore clean boot.img from ROM package in case of problems.

To download older public builds,, click Releases near end of main Magisk GitHub page, scroll to desired version, click Assets, then (zip) file.

To downgrade to pre public 22.0 releases from Manager/app, you'll need to set hosted address of raw json file for custom channel in app Settings. PW
[Magisk] pndwal:
News:

Reason: 😉

What modesty! Age ÷ 4; We like your Dum Dum efforts John.

Thanks for spilling the J Beans... Have a break! Break a Kit Kat...

No one can handle too much desert, but you GOTTA leave some room for a Snow Cone!👍 PW
[Magisk] proza:
On the Installation page, at the bottom, there is a "Samsung (System-as-root)" section. Does this also applies to the custom ROM?
[Magisk] pndwal:
Oooh YES!

If device launched w/ Android 9 or later.

You'll need to patch / use boot image for CUSTOM ROM, however that is packaged though...

Some info (patching tar files etc) will be useful for legacy Sammy devices also.

PW
[Magisk] nowster:
The freeze is a problem with f2fs filesystem in the kernel.

The fix is to use a different kernel, which for the Pixel 3a and 3aXL MVK is the best maintained.

https://xdaforums.com/t/kernel-android-11-v11-6-mvk-maximum-velocity-kernel.3961100/
[Magisk] newsera:
Did you find a workaround for this? I am running Evo X rom on my Poco and have the same issue. I don't even have Magisk installed and I assume by default the rom doesn't provide root privileges.
[Magisk] Xanth0k1d:
I wrote a post on this, you can find it under posts by me.

The vkey thing detects your devuce fingerprint as well, so if u r running a custom rom, singpass will not work.
[Magisk] newsera:
Thank you very much! Let me give it a try!
[Magisk] Mr.Brownstone:
Hi guys, first thanks for the hard work ! I have an issue that I think comes from Magisk: VoIP calls make my phone crash (Whatsapp, signal, etc). Looking at the log it seems to be audioserver that crashes, is there any fix for that ? Thanks in advance ! (FP3+, /e/ OS with microG, no Magisk modules installed) Log is here, see line 2546
[Magisk] zgfg:
Developers are not really here but on Github - link to Gothub is on the Magisk app.

You will need to report the issue there, following the strict requirements (otherwise, ticket might be closed) about (Magisk) logs, phone, Android, firmware, Magisk version, etc (you will see when you go to open the ticket)

Also, make sure you test without Magisk - if you have no module or root app installed, Magisk, IMO, should not affect the audio driver
[Magisk] DualJoe:
How can i edit files in /system? When i do 'sudo vim /system/etc/hosts' it says 'file is read-only'. I also cannot do a 'mount -o remount,rw /system'. It says '/system is not in /proc/mounts'.

LOS18.1
[Magisk] pndwal:
Post Android 10, probably with some effort!

Here's one way, incl. info on new 'Shared Blocks' filesystem:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-84739785

Magic Mount is the way to do it systemlessly using Magisk. It's essentially what Magisk modules do to load:

https://topjohnwu.github.io/Magisk/details.html#magic-mount PW
[Magisk] DualJoe:
Thanks, found the bug. Instead of 'mount -o remount,rw /system' it's 'mount -o remount,rw /'. Not sure if it works on newer devices as well.
[Magisk] Mr.Brownstone:
OK thanks ! 👍
[Magisk] proza:
What is "preserve avb 2.0/dm-verity"? Should I check it or not?
[Magisk] JimSmith94:
I'm not 100% sure what bricked my Pixel 5 but after installing the April Security update and patching boot.img, it was stuck on the fastboot screen with no boot image on slot b. I believe it happened because I patched boot. img without checking and installing the new Magisk Manager first. UbreakIFix was unable to force flash so now I'm waiting for them to get in a new motherboard. As I said, I'm not positive this caused it, but perhaps this warning will keep someone else from doing something stupid like I did.
[Magisk] ineedroot69:
if you have no plan installing custom rom or you have no intention of modifying the partition that are protected by dm-verity such as system.img and vendor.img (see list of partition here https://source.android.com/security/verifiedboot/verified-boot) .... leave it check
[Magisk] pndwal:
Latest Public (Stable / Beta)​

Release Notes and Changelog:​

2021.4.9 Magisk v22.1​

This release is focused on fixing regressions and bugs. Check the v22.0 release notes if coming from older releases.

Note: Magisk v22 is the last major version to support Jellybean and Kitkat. Magisk v23 will only support Android 5.0 and higher.

Bug Fixes​

[App] Prevent multiple installation sessions running in parallel

[App] Prevent OutOfMemory crashes when checking boot signature on PXA boot images

[General] Proper cgroup migration implementation

[General] Rewrite log writer from scratch, should resolve any crashes and deadlocks

[General] Many scripts updates fixing regressions

[MagiskHide] Prevent possible deadlock when signal arrives

[MagiskHide] Partial match process names if necessary

[MagiskBoot] Preserve and patch AVB 2.0 structures/headers in boot images

[MagiskBoot] Properly strip out data encryption flags

[MagiskBoot] Prevent possible integer overflow

[MagiskInit] Fix sepolicy.rule mounting strategy

[resetprop] Always delete existing ro. props before updating. This will fix bootloops that could be caused by modifying device fingerprint properties.

🎉 👍 PW
[Magisk] pndwal:
Latest Debug (Canary)​

Changelog and Release Notes:​

Magisk (f623b988) (22101)​

Sync with public release

Diffs to v22.1​

None

👍 PW