yashsingh1/xdaforums huggingface dataset:
[Magisk] zgfg:
ROMs (didn't use yours but know for some others) incorporate the open source USNF mechanism.

That way they force Basic SafetyNet attestation, and due to the know hole in SN API, they spoof the fact that Bootloader was unlocked

The whole point of the new API is to get rid of the known holes in the old SafetyNet API - therefore the today known tricks to hide that BL is unlocked, that you're running a custom/non-certified ROM or that you have changed the stock firmware (by eg installing Magisk) should no more work with the new Google API (unless and until the new tricks and hacks will be discovered)
[Magisk] HippoMan:
However, if some sort of iOS "jailbreaking" would allow us to mod the device operation in the ways that we like in order to provide desired capabilities more readily than Android would allow with all its current and pending "improvements", then I wouldn't care that iOS itself is closed source.

My objective is not to start a discussion about iOS here, but rather, to make my point that as time goes on, Android keeps getting closer and closer to iOS with regard to customization restrictions.
[Magisk] RandomPooka:
I would tend to disagree. You're still free to root and mod all day long. You can write your own custom os.

But, as far as security is concerned, no. Your custom ROM and device mods will show up as a modified device, or unsupported at the very least.

This is so that security based apps can know that your device is not certified as safe. It's why you can't use fingerprint verification on some banking apps, or even use them at all. Android itself isn't restricted, but the various app developers that are making apps that require security aren't going to let you potentially misuse their stupid with your custom written ROM/mods. Android itself will still function just fine.
[Magisk] HippoMan:
I see. So Google's proposed SafetyNet replacement will probably put 3rd-party ROMs out of business.

Great. (groan)

This is just another piece of support for the assertion that the desirability gap between Android and iOS continues to narrow.
[Magisk] HippoMan:
Of course we could root and mod to our hearts' content, but in doing so, our devices would continue to become less and less usable with regard to banking apps, etc.

Rooting and modding then become greater and greater liabilities as Google's "improvements" continue to come into play.
[Magisk] RandomPooka:
Businesses that deal with money and services don't want you to be able to screw with stuff. That's not a liability for you. That's them protecting their profits and often their customers.

It appears that you have a big disconnect for WHY security measures are on place. That's often due to the "I wouldn't do these VeryBadThings, so it doesn't occur to me that someone else might leverage an opening to do VeryWorseThings"

I personally wouldn't get high and go to work, so I'm always just shocked when we have random drug tests and the test centers have all these things that they look for that I never would have thought of. That's because I wouldn't be trying to get around the test center security and swap out a foreign payload for the actual one. That doesn't mean someone else wouldn't, it that I should get a pass because I personally wouldn't.
[Magisk] HippoMan:
Of course I understand how businesses (including Google) wish to protect their profits.

It's just that these businesses' benefits in this regard happen to be my personal liability. This is the precise reason that the current cat-and-mouse game is going on.

Furthermore, considering banks in particular, as I've mentioned a few times before, they freely allow us to access banking functions on rooted devices: namely, our desktop computers.

And they issue us fully functional debit cards which we keep in our wallets that are just as easily stealable as our mobile devices.

Running a banking app on my rooted Android device would be no less safe than accessing the bank's services via my rooted desktop computer or the debit card that I carry with me.

Therefore, spending money and developer-hours creating "protection" against Android rooting is a huge waste of resources for these banks.

Of course, these businesses are fully within their rights to make these misguided efforts. There's no law against being stupid.
[Magisk] pndwal:
Many (most) of the old signals won't change, but more have been added and the new API / code will accommodate more efficient upgrades too...

https://developer.android.com/training/safetynet/deprecation-timeline

Patching the 'hole' allowing basic (spoofable) attestation to bootloader state etc has not arrived with this API... It may serve a purpose when the time for proper HKA deployment arrives however... PW
[Magisk] pndwal:
Open source is what enables out-house Devs to create those mods/capabilities... In-house (closed source) mods are just iOS enhancements / milestones... 🤪

But Android embraces / allows customisation (ie. custom mods) incl. root!... iOS doesn't!... And Google has given no indication that this will change!...

Of course they guard / protect their own proprietary apps, just like all the banks, game Devs, OEMs etc etc... And as the services / framework provider, they integrate safeguards for 3rd party proprietary apps as well as security for users...

But they have made many concessions to the modding community, eg allowing GApps to be sideloaded on custom ROMs (Kondik thought they would prevent this...), even providing a whitelist to allow the same to install on uncertified devices (China region etc) provided they run custom ROMs...

We need to differentiate between Android (AOSP), Google Apps (NOT AOSP) and 3rd party commercial proprietary apps... These often require a reliable security model / framework... Google just want to make theirs reliable (eg the green, yellow, orange, red states of Android verified boot are reliable/ can't be spoofed so apps get reliable OS environment signals) and prevent abuse, which, frankly, misrepresenting (spoofing) security signals is / can lead to...

The fact is iOS is actually far more secure (and necessarily a fortress / jail in the face of custom development), and Google is just playing catch-up to ensure viability in reality... I for one wouldn't want this uniquely moddable mobile OS to loose that race. 😬

Security might prevent us running some proprietary code on customised devices, but it actually safeguards the best open source mobile platform for legitimate mods and modders just as it protects stock development and users. PW
[Magisk] pndwal:
So why do they do it?

So that's the reason... They're just stupid!... And I'm insane... 🙃 PW
[Magisk] HippoMan:
Of course you aren't insane. But these anti-rooting efforts are indeed an example of stupidity on the part of the banks. You show a lot more common sense than the people paying for the development of these anti-rooting features in banking apps.

If they went to the same trouble to get software installed in browsers and operating systems to prevent or cripple access to their banking software on rooted desktop computers, then I would at least give them credit for consistency, and I wouldn't accuse them of stupidity.

Likewise, if they crippled the use of debit cards because anyone who steals them (in the same way that a mobile device can be stolen) can freely use these debit cards buy things, I again would give them that same credit for consistency.
[Magisk] jons99:
cause think what would happen if a bank call Microsoft and tell them that if they won't block their users from going to system folder any other folder they would block users who use windows? Microsoft will tell them yeah go ahead and block 90% of your costumers and see how it goes for you
[Magisk] HippoMan:
Only a small percentage of mobile-phone users want to use rooted Android devices. The amount of money any given bank can lose specifically via mobile-device hacks on all the rooted Android devices in the world is very small, relatively speaking, and I believe it's smaller than the amount of money spent on developing anti-rooting "protections" in banking apps. If I'm wrong about this, someone please correct me.

On the other hand, there are literally millions upon millions of desktop computers in the world which potentially can be hacked with keystroke monitors and other exploits being installed. Banks are no doubt losing a lot more money as a result of these hacks. Yes, the banks can't ask companies like Microsoft to cripple their OS, but they could require desktop banking users to install some sort of anti-virus and other protective software. But they don't.

Also, banks lose a lot of money from internal hacking ... i.e., hacking via direct efforts of unscrupulous employes, and hacking that is accomplished by people taking advantage of loopholes that are present because some of the bank's' honest employees don't properly follow existing security procedures ... and by managers who don't even understand these procedures to begin with and thereby don't enforce their use among their own workers.

These internal losses dwarf the losses that a bank could incur via the relatively small number of rooted Android devices in the world, even if each and every one of those rooted Android devices get hacked ... and again, I believe that the anti-Android-rooting software development efforts cost more than these potential losses on rooted Android devices.
[Magisk] jons99:
this is off topic so it'll be my last response about it but let me tell you if my bank will force me to run some antivirus app that will monitor everything I do 24h a day I'll probably change bank
[Magisk] gorman42:
Unfortunately I don't remember if I did.

Generally speaking I have not kept a precise record of what happened, I am sorry. I pretty much... well... panicked when a procedure that I expected to go smoothly (after doing it several times in the past) suddenly created a problem that cut me out from banking apps and State ID apps. I am definitely glad that I managed to solve it and I wouldn't have been able to without your help (sometimes it's helpful even just having somebody else to share thoughts with in situations like these).

So, really, thanks a lot for all you did. It's been much appreciated.
[Magisk] RandomPooka:
Banks, sales, and subscription service platforms to Google: Is your platform safe so we can prevent scams and theft?

Google: Meh. I dunno. Probably? Maybe-ish.

Aforementioned services: We won't offer apps on it, then.

What secure apps do you use on your PC for banking? A web browser. Does your bank have a windows specific app that you've downloaded and installed, or do you go through the browser, which Google, Mozilla, Opera, etc all make as secure for transactions as possible.

I'm also done with this conversation, because you seem to be going out of your way to be obtuse about it. You specifically mentioned that rooted users are a microscopic minority. None of these corporations enacting the security measures are going to go out of their way to make security exceptions for the tiny fraction of android users that are rooted users.
[Magisk] un4free:
@pndwal just to keep you updated, I have managed to update magisk 23 to 25, THANK YOU

With your help and the ton of posts from people who finally restored Google wallet, I too have a functional google wallet with root

Many many thanks for your kind help 🥰
[Magisk] m0han:
For the interested: https://xdaforums.com/t/discussion-magisk-the-age-of-zygisk.4393877/post-87200005
[Magisk] czerwinski76:
Use this app please :

Terminal Emulator for Android

Terminal Emulator for Android - Apps on Google Play

Access Android's built-in Linux command line shell. Unleash your inner geek!

play.google.com
[Magisk] nikem:
please help me ... I have the mytim application not working for me ... it gives me "modified device" in magisk and enabled in the sites to hide. thank you
[Magisk] svendsvin:
A lot of good hints in this thread (link below). It is not to bloated yet so you can use search option and find decent answers. Also about what to write in more detail so that you can qualify your question. I believe the good and knowable people of this thread need this to help you.

https://xdaforums.com/t/discussion-magisk-the-age-of-zygisk.4393877/
[Magisk] V0latyle:
Let's not forget the security issues that rooted devices present. App developers for the aforementioned banks, etc are extremely concerned with operating in a secure environment. You wouldn't want a third party to be able to view, let alone manipulate, your financial transactions, but a rogue process with root permissions could potentially do exactly that - read account numbers, command unauthorized transactions, and worse. Think of it like a malware browser extension that could give a remote party access to your bank account.

From the developer perspective, every single rooted device is a compromised security environment, and this is 100% true. There is no easy way to determine whether the end user is using root carefully with vetted applications, or if the device has been hijacked by a malicious rootkit. So, developers use methods such as SafetyNet, Play Protect Certification, and the new Play Integrity API as a means to try to verify the security environment of the device.

Try to look beyond your own inconvenience as a rooted user and understand this concept. The end answer is simple: If you want an app to work correctly on your device, do not modify your device or software.
[Magisk] HippoMan:
... and don't forget that your desktop computer is another rooted device.
[Magisk] V0latyle:
Of course, but you're essentially suggesting that financial institutions should give up on mobile security because of other potential threat vectors. It's simply not going to happen, and I've explained why.
[Magisk] 73sydney:
Its trivial to sniff or even MITM a desktop, or even just run WinPE and reset admin password and use the users own saved passwords in their browser, heck even export their passwords....

In any event the biggest risk vector is social engineering

Chasing root phone users only gives them a "feelgood", it does nothing to stop genuine misuse and fraud, at all.....

I dont see Google or a bank sending out a representative every time someone makes a transaction to see if theyre genuine....trying to control the device is attacking the wrong end of the transaction and is ultimately pointless
[Magisk] baxtex:
Sorry, this has probably been asked a thousands times. What is the recommended way to hide root/magisk these days? One of my banking apps started to check for root and now I cannot use it anymore and they dont have a website.
[Magisk] zgfg:
There is no single method that will work for all 'banking' apps since they use different tricks to search for 'root' (they do not search only for Magisk but for any hint that your device might be modded)

Moreover, methods may slightly differ for different devices and (specially, custom) ROMs

Hence there were really 'thousands' posts about, in this thread, in the new Magisk Zygisk thread and another thread specially devoted to 'hiding root'

Methods include putting the app to DenyList, trying with Shamiko module, hiding the Magisk app (even up to uninstalling but only the app, or by disabling the Magisk app or using LSPosed module Hide My Apps)

In some hard cases you might try your luck with Magisk Delta Fork (separate thread also here on XDA), that still provides the old MagiskHide (and the app comes with a different package name)

But in some cases even the primitive tricks may be needed, like to additionally delete or rename TWRP folder

You see, no single method will fit all, and I cannot write you now a novel to describe all the methods

The best advice: try to find if somebody else already 'cracked' the same app you are talking about, and how (s)he did. Or read the similar posts and try yourself various hints

First of all, make sure you pass SafetyNet, or nowadays the upcoming new Play Integrity - MEETS_DEVICE_INTEGRITY (but that is also a topic for itself). Hint: Universal SafetyNet Fix

---

There is a problem how to properly search in this or other XDA threads for the given keyword(s)

This was also described in this thread but it's now buried down and you cannot find, unless you already know how to search😁

About searching, see the guide in another similarly huge thread (I just answered to somebody else this morning):

https://xdaforums.com/t/rebrand-update-tool-hwota7-p9-eva.3820849/post-87204239
[Magisk] V0latyle:
They're not chasing root users. They just want a guarantee that the device is secure, and they have good reason to. Rooting by nature compromises device security.

I'm not saying your opinion is invalid; in this context however, it is irrelevant, because regardless of how you may feel about the situation, it's not going to change.
[Magisk] baxtex:
Thank you so much. Turned out my phone did not pass safety net. I installed Universal SafetyNet Fix and it fixed the issue!
[Magisk] zgfg:
Today I retested S-Check on my Xiaomi Mi 9T, MIUI 12.5.2/A 11

Magisk Delta Canary 13275b8c (latest) with Shamiko v0 5.2 (120)

And bingo - now S-Check passes (screenshot attached)

Btw, last week I didn't pass S-Check (it always detected root).

And since then, only Magisk Delta and Shamiko were upgraded

PS:

OEM Unlocking is allowed in Developer options, I e sys.oem_unlock_allowed=1

----

On my another phone, Xiaomi 11 Lite 5G NE, MIUI 12.5.8/A11, with Magisk Canary 9b61bdfc, also the latest Shamiko v0.5.2 and with USNFv2.3.2, S-Checker still detects Root

PS:

Disabling OEM Unlocking in Developer options , ie sys.oem_unlock_allowed=0 (with reboot)

does not help either
[Magisk] dedaol:
Hello,

I've an Oneplus Nord running ArrowOs Android 12. I put Magisk 25.2 on it and UniversalSafetyNetFix. I've put most stuff on Denylist. I hid the Magisk app. My Banking app only works, if I additionally hide the Magisk app with some other means than the built-in method. On Android 11, I used AirFrozen, on Android 12, I used an app called App Freezer from MobizSystems from the Play Store. It asked for root, I gave it root for 30 minutes, I've frozen the Magisk app, and everything seemed fine.

A new update arrived for my OS, which I installed, and before reboot, I wanted to install Magisk to the inactive slot. I fired up App Freezer, which stuck at the logo. It didn't ask for root, nor did it work. I downloaded and installed Magisk v25.2 APK, and to my surprise, it doesn't detect that I have Magisk installed. But I do have Magisk installed, I can adb shell, and use su, which I allowed in Magisk, when I still had access to it.

I've rebooted to recovery, and installed Magisk to the upgraded OS, booted it up, everything works fine (GPAY, banking app), except App Freezer, and Magisk app.

Is there a way out of this?

Most likely I've put something on Denylist, that prevents asking for root, and even Magisk app to detect installed Magisk.
[Magisk] rodken:
Explore these two options [here and here] to alleviate the possiblilty that your Magisk installation might be botched after the update of the OS.
[Magisk] zgfg:
Possibly very simple. You did Hide Magisk App but did not Restore Magisk app before upgrading Magisk?

If so, there are really tons of the same cases/posts/answers...
[Magisk] zgfg:
APK Downloader Download Best Apps & Games FREE for android in United States Store - Version: 1.0

Download Apps latest version, older versions, new releases, Faster apk downloads and apk file download games & apps from App store Google Play Store

steprimo.com

App release year 2017 (if indeed)

Description says it's a checker for Play Integrity (they don't name it SafetyNet)

Result confirms "basic integrity" - do they refer to basicIntegrity from SafetyNet API or MEETS_BASIC_INTEGRITY from Play Integrity API (frankly, requirements are similar except for one small detail - see below)

Since result mentions the need that app should have been installed from Google Play store (that small detail), it actually better fits to the 'new' MEETS_BASIC_INTEGRITY than the 'old' basicIntegrity

Did Google already have something like the new Play Integrity on their table back in 2017, but they made it somewhat simpler and pushed under an IMHO more catchy SafetyNet name. And now that they are stepping back...
[Magisk] HippoMan:
Yes. And Android root is low-hanging fruit. Considering the number of rooted Android mobile phones in the world in comparison to the number of other devices and the number of rooted desktops, all the "protection" against Android root makes a very small difference in the total amount of money lost because of hacking, and it's unclear as to whether the development costs of this anti-root "protection" aren't more than the losses from hacking that this "protection" is supposed to prevent.

Agreed.
[Magisk] Carne92:
Hi guys, I've a problem when I install the file Magik-v8.zip from SD card, becouse my tablet (I hope it isn't a problem if I work on tablet) returns me this code:

! Image mount failed...abort

E:Error in /external_sd/Magisk-v8.zip

(Status 1)

Installation aborted.

Do you know some fix to solve this problem?

I'm working on Samsung Galaxy 2 10.1 with a rom that mount android 5.1

Sorry for my bad english

Thanks everybody
[Magisk] Portgas D. Ace:
Quick question: what's the file path for the stock-boot.img?
[Magisk] Truenox:
I don't pass safety net with the Magisk v8 + phh superuser r259 method. I have a note 3 (5.0 original rom PH2)... any solution? :/

I follow the zapahacks tutorials...
[Magisk] jigg3:
I'm not able to delete magisk manager via adb shell command : Failure [DELETE_FAILED_INTERNAL_ERROR]

when I list via adb shell all packages, I'm able to see magisk but uninstalling it is not possible.

Also I tried to update Magisk from v6 to v8. I uninstalled with Magisk uninstaller first, afterwards I flashed Magisk v8 and installed phh superuser r259 but I'm still getting message that root is installed inproperly.

Shall I firstly update from v6 to v7?

Any ideas ?
[Magisk] Immortalis:
It's in /data
[Magisk] Portgas D. Ace:
Strange, as for me there is no boot.img in /data :confused:
[Magisk] zapahacks:
I updated my post, you can try again if you want. Good luck:good:

Good!, thanks for sharing :good:

Good! :good:

I updated the post to try to make it more clear :good:

Good, again :good::good:

:cowboy::cowboy: :highfive:

---------- Post added at 01:18 PM ---------- Previous post was at 01:01 PM ----------

I updated my original post, you can give it a try, I know now things are working for many other people. And I have no idea why it only works for me with mod2. Other people have reported that oficial version works fine. You just need to try and see which is your case

I updated my post to try to make things more clear, perhaps you could try. I know it works on samsung galaxy s7

Try the last step of my updated post. I use the latest version. It should work. But hardware rebooting messes the trick. Try to enable xposed, reboot normally, hide again xposed and then play. Hope it helps:good:
[Magisk] grep_i:
There is none it is in your rom image.

---------- Post added at 03:27 PM ---------- Previous post was at 03:19 PM ----------

I guess the guy answering you was thinking you meant the backup of stock boot.img

As you flash SuperSU it automatically makes a backup of your boot.img to

/data/stock_boot_hexcode.img.gz

So if you rooted you can find stock boot.img in /data in gzip compressed format.
[Magisk] Captain_Throwback:
Magisk backs up stock_boot.img and puts it in /data.
[Magisk] grep_i:
Nice, so Magisk does a similar thing as SuperSU minus the hex code in the filename.
[Magisk] snke:
Probably is related to my internet provider to verify SN status, with mobile carrier I don't have any problems :eek:
[Magisk] Portgas D. Ace:
Thanks for clarification. I was just wondering as I didn't see any stock-boot.img file inside /data. But as I don't use Magisk right now... well, self explaining.