yashsingh1/xdaforums huggingface dataset:
[Magisk] pndwal:
Well, I said 'made Android their mobile OS'. I don't think ChromeOS even qualifies. 😬

On a flagship Pixel device, Google owns virtually the entire Android OS outside of the hardware drivers. It's not an AOSP version, but, of course, users can always flash one.

And, sure, AOSP is more complex, I didn't deny that, but Google founded the OHA, is still the parent organisation, and still hosts and leads development.

Google started the Android project, oversees the development of the core Android open source platform and works to create robust developer and user communities. They chose the Apache License 2.0 (rather than a copyleft license) believing that it encourages widespread Android software adoption.

Google themselves committed engineering resources to ensure that Android is a fully competitive software platform, treat the Android project as a full-scale product development operation and strikes the business deals necessary to make sure devices running Android make it to market.

Please see Google's documentation on AOSP development, Google's strategy, in-house testing done on their own flagship devices and how these absorb risk before an AOSP version is passed to OEMs, how and why some parts of the next version of Android including the core platform APIs are developed in a private branch before releasing them to the experimental and stable branches.

https://source.android.com/setup/start/faqs

The fact is (as shown in the FAQ above) Google works on the next version of the Android platform (AOSP) in tandem with developing a flagship device.

Simultaneous to mass production, the Google team themselves prepare the open source release by making final API changes, updating documentation, preparing an SDK for the new version, and launching the platform compatibility information. Then their legal team does a final sign-off to release the code into open source. Google signs the Contributors License Agreement attesting to their intellectual property ownership of their contribution.

So at its core AOSP is Google owned, flagship devices get the core Google APIs before AOSP, and Android is very much Google's mobile OS, and baby!

And then there's Google's role in the Android Compatibility Program & CTS... (See Compatibility section, same ref. above)

Other parties are free to modify or contribute to AOSP source code, but they’re not the ones who produce major milestones. It’s Google who ultimately drives the Android operating system, even if it’s not the one who owns every last bit of code.

https://www.androidauthority.com/who-owns-android-1164938/ PW
[Magisk] Stillhard:
I use Magisk

- End of discussion -
[Magisk] pndwal:
- No, I think that's the problem; they don't want to, but allowing unlocking for any such mod is fraught for them.

They're caught between keeping their system unique in that it allows customisation, and serving the needs (essentially security for code and data) of both big corporations and Joe public.

Really, the only problem results from bogus SafetyNet attestation (and it's derived bogus PlayProtect certification). That's what we have now thanks to MagiskHide and other mods. And that is the one thing Google have been clearly against; such mods 'subvert their security model'.

With accurate attestation to a certified unmodified platform (ie. Trusted Execution Environment) the issue goes away. There is now no need for Google to be against either root, or custom ROMs.

It's like "We can give modders their custom ROMs, patches and root, and keep in good with corporate partners and customers... Modders can have all their cake... But no cherry, mind!"

- Yup, the latter.

They likely could distinguish between all sorts of mods, but why? Either way, none of these mods have been submitted to Google for Play Protect Certification or have met standards for security and performance for Play Protect partners, and as such have no business passing Compatibility Test Suite.

https://www.android.com/intl/en_in/certified/

The answer for Google is thus the same: ensure accurate attestation to TEE with Hardware Backed method. Existing bootloader flagging is the obvious starting point for a chain-of-trust that can be queried for this; it just needs to be made bulletproof.

Further, as I've mentioned, Google's Shawn Willden has already indicated that the solution for modders wanting the cherry too, is to get custom ROMs certified by Google so bootloader can be re-locked with proper signing to pass CTS. An LOS rep has responded to this too, but so far it has never been done...

Here's hoping! 😐 PW
[Magisk] dd805bb:
Again might want to reread what you are installing. Go to the GitHub, scroll through the issues... You end installing certs so com.netflix.mediaclient sees you as being legit. How do they that? So yes you are using the play services but signed to look you got play services. Stock APK will not work any other way. I wouldn't be using that. And I get the way sai works. Those other two apks are work around to use Google play services. I would reread what you are installing. Netflix is a singular APK when downloaded from Google play, APK mirror or any other way. It is a stock Netflix APK from the Google store. Netflix doesn't have open source apks. What do think you are installing? I am curious..
[Magisk] 73sydney:
Slightly OT, but have you seen this bunch of numpties (fools/idiots for our non-Aussie/ English friends)...they make a custom ROM you can lock the bootloader on again, but then they go on to use everything sans-google and even advised use a faraday bag to "be safe"...i wet myself laughing

Home - DivestOS Mobile

divestos.org

Legit "Post Install" tips:

Physical Protections​

Apply a privacy screen protector​

Privacy screen protectors limit the viewing angles of the screen they are applied to, resulting in a dramatic reduction of what people and cameras around you can see. They can be purchased for around $4 on eBay and similar sites. The glass ones are the best as always, but some older phones seem to only have the plastic film ones available. Be warned, they noticeably reduce the brightness and add an ever so slight screen door effect. If your phone doesn't have the brightest of screens it will become near-impossible to see in sunlight and also impact camera/videos experience.

Keep a faraday bag handy​

Faraday bags for phones can be purchased for around $10. They are absolutely essential if you have a phone without a removable battery or are in high-risk areas often. Putting your phone in their inner flap will will prevent all relevant (typically 0MHz to 4000MHz + fair reductions of higher frequencies) radio signals coming/going to your phone.

Wear a hat​

Plain baseball hats can be purchased for around $6 and provide a decent reduction in visibility of your face to cameras.

You cant make this stuff up folks
[Magisk] zgfg:
Wrong

I just installed Netflix from Google Play - the official way, and the screenshot below from my /data/app proves that it installed to my phone as a split/bundle app, not as a singular app

Also, search for Netflix at ApkMirror:

Netflix 7.105.0 build 10 35484 APK Download by Netflix, Inc. - APKMirror

Netflix 7.105.0 build 10 35484 APK Download by Netflix, Inc. - APKMirror Free and safe Android APK downloads

www.apkmirror.com

As on the other screenshot below, there is also a split/bundle Netflix installation available from ApkMirror

Anyway, this discussion about the means of split/bundle apps is off-topic here, hence I will no more answer on this
[Magisk] DiamondJohn:
On all phones I have ever owned (all with unlocked bootloaders), the bootloader is re-lockale. The bootloader is NOT part of a ROM (I also use to compile custom ROMs from source), but it is part of the firmware. i.e it is closed source and provided by the manufacturer. The catch with phones I have owned (and I think its pretty standard) is that when unlocking, they physically blow a fuze/diode so that there is an indelible mark that the bootloader has been unlocked at some point. I once re-locked the bootloader on a phone after I had installed a rooted custom ROM
[Magisk] dd805bb:
And that is what is in the Netflix APK. A base APK and more. But it is downloaded as one APK. Sai on that other thread actually installs the other APK you show and I dont. Those other two tell the legit Netflix app you are using Google play services. A base APK doesn't prove Netflix is not just one APK file. I downloaded it. Before opening and installing, it is one APK..yes APK files contain more than just a base APK. They do not contain the sai from that other thread period. That other thread runs the official Netflix app with two other apks. Not breakdown the original Netflix say that it's those apks. Again might want to reread wtf you are doing. Because you keep giving screwy information. Screenshot from the Netflix download... One APK.... Yes installing any APK installs more files than just the base APK. Great point, but not what that other sai is on the XDA thread.
[Magisk] pndwal:
Re Qualcomm (MTK may have similar), one QFUSE fuse row labeled Qualcomm Secure Boot is always 'blown' for devices reaching market on non-Chinese deivces (OnePlus may have exceptions). This indicates that PBL (Qualcomm’s Primary Bootloader) is verified and loaded into memory.

Some users have got confusing notifications about this on unlocking or locking Bootloader, eg Nexus 6P "QFUSE: ENABLED". This apparently is just a warning that a public key is (from factory) stored (indelibly) in qfuse so relocking bootloader will require properly signed stock images, and unlocking will wipe data. Ie. it's nothing unusual and nothing to worry about!

Seems in-house Google Devs working on DSP apps or the bootloader itself have devices with that particular fuse empty (no key), and the device will run any low-level firmware.

https://www.androidpolice.com/2015/...have-efuses-and-why-should-i-care-about-them/

Other qfuses are are OEM configurable, eg used to implement additional cryptographic checks into their bootloader sets to attempt to further security, or present a function (like allowing bootloader unlock) to the end user.

Samsung is a prevalent example (their 'knox' fuse affects (disables) Knox secure partition use, etc). Motorola also configures a single QFUSE that must be blown to unlock the device, permanently voiding the warranty.

(And Sony use of a different cryptographic method incl. a bit set on their “TA” partition to allow unlock.)

Other than the above, User 'blowable' fuses are apparently commonly left unconfigured / unused. See LOS article:

https://lineageos.org/engineering/Qualcomm-Firmware/

Interesting info regarding relocking bootloader with custom ROM from John's new chief. 😛 Some may already know - seems signing key is key. 😉 : www.twitter.com/shawnwillden/status/1238131039844864000

🤠 PW
[Magisk] DiamondJohn:
Just some extra info, I only ever did it once, I realised on the next update of TWRP i couldn't flash, that unlocking the bootloader again, wiped all my data. It was a silly move on my part many many years ago to remove an annoying red warning padlock on boot, that was only visible for a few seconds. I learnt my lesson and never did that again, and was not suggesting it as a good option; just confirming the possibility. PS: I think it was a Nexus 5
[Magisk] pndwal:
Yep... But could be a good option for App's (banks) that detect unlocked bootloader without checking ctsProfile / SafetyNet (or even with check if can be locked w/ Magisk root, hiding and spoofing working - ?),but these would be rare cases.

Agree that this, without Google validated system image, will be useful only for those desperate enough to wipe and setup from scratch (flash backups, etc) w/ any updates... and any worried (paranoid?) about security. 😬

Haha! ... Seems Nexus have more warning messages than most, but all have the feature. 😜 PW
[Magisk] yipchunyu:
Green user on Magisk. I installed below and used the magisk hide. Most of the app works but not the HSBC mobile app.

Any help is greatly appreciated.

Magisk

Installed: 23.0 (23000)

Ramdisk: No

A/B: No

SAR: Yes

App

Latest: 23.0 (23000) (21)

Installed: 23.0 (23000) (21)

Package: bh.u.ms.gipdj.mibk
[Magisk] pndwal:
Bank app? - It'll be checking SafetyNet API at least.

Confirm SafetyNet check in Magisk App; both items pass.

Otherwise:

Toggle on MagiskHide in Magisk App settings.

Need MagiskHide Props Config Magisk module ONLY if running uncertified stock (Chinese etc) ROM, or Custom ROM (not always necessary for custom) to spoof Certified fingerprint.

Need Universal SafetyNet Fix module (even if evalType already shows Basic, for 'under-radar' Hardware based detection that still occurs when Magisk SafetyNet Check sees Basic evalType) on modern devices.

Check PlayProtect status in PlayStore settings shows 'Device is certified'. If not, try toggling off and on again MagiskHide in Magisk App settings, clear PlayStore and Google Play Services data, Reboot check again.

Toggle on hide from root for bank app in MagiskHide hide list.

Clear bank app data, reboot, set up bank info and check if detects 'root / jailbreak' / modified environment etc any more.

If this still doesn't work, bank app is probably employing custom detection methods as SafetyNet API is (obviously) flawed and unreliable for their purposes at present.

Most of these methods are known, and there are recent fixes even for difficult to hide 'Isolated process' detection (discussed in this thread), so please report back for help.

🤠 PW
[Magisk] klemi71:
Please try to help.

I upgraded my Pixel 3 from stock may to June Android 11 as each month before. To keep data I removed -w from command in flash all.bat as usual. No problems so far, device boots.

To regain root I created patched boot image and flashed it from fastboot. Device starts booting, passes Google logo. "Smartphone is started" shows no progress; instead there's a message that device is turned off. It reboots, ending in a screen that offers to try again or do a factory reset. This happens when I flash it to active slot only as well as when I flash it to both slots.

I can bring back unrooted system by flashing stock boot.img to both slots, it boots up normally again.

Tried it several times, same result.

Flashing May version again results in stucking at Google logo, reflashing June brings me back to described situation.

Latest Magisk canary installed, modules disabled before update; older Magisk versions show same result.

Kirisakura Kernel latest was installed before update;

there is no working flashable TWRP for Pixel 3 Android 11, booting in older version to uninstall Magisk or flash it from there failed.

I don't know if stock recovery mode supports adb sideload to try uninstalling Magisk (renaming APK debug to zip and flash it?). Maybe Magisk needs to be completely removed to start clean. 🤷🏻‍♂️

Wiping and fresh install would be a disaster for me at the moment - time!

Do you have any suggestions to solve my problem?

More information needed?

Best regards.
[Magisk] ascendant512:
Hi all,

I tried to install Magisk on my Sony Xperia Z3 Compact and after rebooting, it still says it is not installed.

The phone is running CARBON-CR-8.0-PAX-RELEASE-z3c-20210520-0416.zip from https://get.carbonrom.org/device-z3c.html

I extracted boot.img from the zip and patched it with the installer. Log attached. After "fastboot flash boot magisk_patched-23000_VYidh.img" and rebooting (adb logcat) the app says it's not installed. Apps don't prompt for root either. The install log shows some cp: operation not permitted for magisk binaries towards the end.
[Magisk] tramp20:
The same on all older Xperias:-(

You have to do a small and simple patch:

Magisk 21.2 cannot be installed on Sony Z1c with Android 10 Lineage 17.1 · Issue #3636 · topjohnwu/Magisk

Description The last Magisk version that could be correct installed was 20.4. All versions after 20.4 fail (from the first canaries to 21.2 magisk-debug_6d88d8ad). 1.1 Flashing magisk-debug_6d88d8a...

github.com

This is a patch from dev bleckdeth and it works perfect even with Magisk_23001.

Main thread was https://github.com/topjohnwu/Magisk/issues/3636
[Magisk] z1022:
how to apply root for app in magisk-Lite?

thanks
[Magisk] zgfg:
When I switched from Canary (or Stable, or Alpha), all apps that previously were granted root, continued to have root privileges in Magisk Lite

Then you still have Superuser and Magisk hide tabs, but the latter one behaves differently than you are accustomed to

When you want to grant a root to an app, you will probably need in parallel to disable MagiskHide for that app (because MagiskHide is by default enabled for all non-root apps)

Maybe 10-14 days back I had experimented with Lite (and specially the modules) and posted two posts here, maybe you find something useful
[Magisk] klemi71:
I tried flashing renamed APK debug to uninstall Magisk completely using adb sideload, but it didn't work for me. I just want to reinstall Magisk from the scratch. Could anyone help me out?
[Magisk] pndwal:
This issue?:

https://github.com/topjohnwu/Magisk/issues/4319

Some have been able to flash 21.4 w/ this problem.

I'd give @vvb2060's latest Alpha Magisk a go too. He's merged a number of fixed since John Wu's last builds that may (possibly)have solved this:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-85103975

Please let us know if you try.

To try either build, I wouldn't worry about complete Uninstall; Magisk (mask) itself is uninstalled completely by flashing unpatched boot image. App settings (MagiskHide list selections, SuperUser selections) and Modules remain after Magisk App uninstall (they are in /data/adb). Only modules are generally a potential problem, but your issue wasn't caused by a new module. See note below.

With system booted from unpatched boot image, simply uninstall current Magisk App and Install older 21.4 or newer Alpha Magisk App, check Settings channel is correctly set to Stable or Alpha, patch boot.img extracted from current ROM archive, copy to PC using ADB pull (not MTP as per John's Installation Instruction page), flash it using ADB Fastboot.

Nb. If you suspect a module (previously installed) may be preventing system booting with Magisk, easiest way is probably to boot to safe mode (google method for your device), then immediately reboot normally. This disables all modules, and you can re-enable later.

Hope it helps! 🤠 PW
[Magisk] J.Michael:
Flash stock boot image. Make sure device boots normally.

Flash Magisk-patched boot image. Boot to Safe Mode. Reboot. See if boots normally.

Depending on how you boot to safe mode, it might be easier to "say" you want Safe Mode as you are shutting down stock system; then flash patched image; then have first boot be Safe Mode. Or it might be that you should boot stock to Safe Mode before flashing patched image. I do not know your options.
[Magisk] 73sydney:
@zgfg @pndwal

Just a quick update

Magisk Lite continues to keep root detection at bay for both my current bank (WestPac), and my new one (ANZ) and my Samsung Wearables continue to work

Sadly the one only issue is that the only modules i can use without tripping Magisk Detector are:

Swap Torpedo (disables swap, recommended if you have 3Gb+ of RAM and dont play games - if anyone reads this and wants to try, note dont use the one in the OP of its thread (its not in repo), use this one instead, its been updated)

Universal GMZ Doze

Normally im running 8 or 9 modules :)

What wont work:

V4A - it installs two apps and neither will work

Font modules - all trigger Magisk system file detection

Terminal Debloater - one module i really use on every ROM i flash to debloat them - i really miss this. Ive had to use a system app remover while on Magisk Lite.

Im about to try clean flashing and using Alpha again with new bank app, also noticed a few posts about installing Magisk (including 23/Canary), loading modules and then uninstalling Magisk app is allowing some to use their finicky banking apps in other threads
[Magisk] yipchunyu:
tried to install the Universal SafetyNet Fix.zip after reboot the system (via twrp?). it now won't able to boot into the system (just showing MIUI). any help?
[Magisk] ZeroKey92:
I could use some help with my OT3T. I'm running LineageOS 18.1 20210607 nightly build and Magisk 23001(21) canary.

Also a fresh install of both.

Followed the the install instructions to a T.

Install manager app -> extract and patch stock boot.img -> copy patched file to PC -> flash with fastboot to boot partition -> reboot.

Fastboot showed a successful flash.

Result was that the manager app is still showing that magisk isn't installed.

Edit: Just tried the not recommended way by installing through TWRP. Same result.

Edit2: Read through the bug reports/issues on GitHub and found a solution. It is a bit messy but it works.

Here is the link to it.

Edit3: In case anybody has problems with their banking apps detecting root/magisk even with magisk hide working, I can recommend using IceBox. Do the normal dance you need to do, to install and hide your banking app with magisk. Then freeze the "hidden/renamed" magisk app with IceBox. That should get around the more resilient root detection.
[Magisk] pndwal:
Just reporting I just checked Magisk Detector results again, and now have 1 item detected : Init.rc has been modified by Magisk. 🤔

Seems something has changed, but I have applied no new mods since...

So I checked out the Momo app itself (Momo "is the strongest detection app known"). Link on /Riru-MomoHider page:

https://github.com/canyie/Riru-MomoHider

Result:

Interestingly, it gives 4 detection issues and 2 other traces, but not "init.rc is modified", which is listed among items Momo detects in Riru-MomoHider GitHub page (?)

I'll try suggestions (same page) re. removing SuperUser programs etc when I get time. PW
[Magisk] pndwal:
Not sure what you mean here. Are you saying you flashed module from TWRP?... But it's a Magisk module! 😬 PW
[Magisk] 73sydney:
fwiw, before i just flashed a new ROM, and while my previous ROM was working fine and the banking apps were fine, Magisk Detector always had init.rc flagged as being modified. Sadly i never tried Momo detector on it....if i end back up on Magisk Lite again ill try it

update:

clean flash of new ROM, magisk alpha, riru and riru-momohider

Magisk Detector flags: su in path and init.rc detection...thats out of the box

this is before adding the config flags, which is my next step...after i test with Momo....for some comparison data

Momo result (out of box - perhaps not surprising as you have to have MagiskHide off):

note: i do not have USB debugging turned on

update #2:

after executing:

touch /data/adb/modules/riru_momohider/config/isolated

touch /data/adb/modules/riru_momohider/config/setns

touch /data/adb/modules/riru_momohider/config/app_zygote_magic

touch /data/adb/modules/riru_momohider/config/initrc

nothing changes in Momo form above.

Enabling MagiskHide again and testing in Magisk Detector, i get flagged for: init.rc...it does not detect su in path

Theoretically my banking apps should work...as this is the same environment i had with Magisk Lite. will test and update
[Magisk] zgfg:
Systemless debloatig works perfectly, however there is maybe a problem with your debloater and its command line interface

The following one has IMHO even easier interface, you just give a list of the system apps you want to debloat in a text file. From the log file you can see all the other system apps, you make a new list and apply again until you are satisfied with the debloated system

Working with Stable, Canary, Alpha and Lite:

https://xdaforums.com/mi-9t/how-to/magisk-module-systemless-debloater-t4180083

PS: I did but only one dirty test with V4A and it didn't work (didn't repeat with the proper uninstalling and reinstalling the module). Maybe the Lite does not support SEPolicy rules
[Magisk] 73sydney:
Does your debloater also work for apps under vendor etc?
[Magisk] klemi71:
Thanks, but it didn't work.