[Magisk] d8389:
1. Install strace binary if your system has not one (attached)

2.

adb shell

herolte:/ $ su
su
herolte:/ # ps |grep nia
ps |grep nia
u0_a731 28352 3294 1887976 307604 do_signal_ 00ef6068a4 T com.nianticlabs.pokemongo
u0_a731 28660 3294 1289420 18344 SyS_epoll_ 00ef6068a4 S com.nianticlabs.pokemongo:pgp
herolte:/ # strace -f -p 28352 -o /sdcard/trace.txt
herolte:/ # grep access\( /sdcard/trace.txt
grep access\( /sdcard/trace.txt
28352 access("/data/data/com.zachspong.temprootremovejb", F_OK <unfinished ...>
28352 access("/system/bin/app_process_init", F_OK <unfinished ...>
28352 access("/system/bin/sh", F_OK <unfinished ...>
28352 access("/data/data/com.chelpus.lackypatch", F_OK <unfinished ...>
28352 access("/data/app-lib/net.snclab.RootKeepSurvival-1", F_OK <unfinished ...>
28352 access("/system/lib/libsubstrate-dvm.so", F_OK <unfinished ...>
28352 access("/system/bin/cat", F_OK <unfinished ...>
28352 access("/dev/.su.d", F_OK <unfinished ...>
28352 access("/system/xbin/supolicy", F_OK <unfinished ...>
28352 access("/data/data/com.formyhm.hiderootPremium", F_OK) = -1 ENOENT (No such file or directory)

28352 access("/data/app/sa.root.toolkit-1.apk", F_OK <unfinished ...>
28352 access("/data/data/net.snclab.RootKeepSurvival", F_OK <unfinished ...>
28352 access("/system/usr/we-need-root/su-backup", F_OK <unfinished ...>
28352 access("/vendor/lib/liblog!.so", F_OK <unfinished ...>
28352 access("/sbin/magiskpolicy", F_OK <unfinished ...>
28352 access("/data/data/com.mypackagename.superuser", F_OK <unfinished ...>
28352 access("/dev/com.mypackagename.superuser.daemon/server", F_OK <unfinished ...>
28352 access("/data/data/com.RootBackupKeeper13_3", F_OK <unfinished ...>
28352 access("/data/data/com.noshufou.android.su", F_OK <unfinished ...>
28352 access("/system/xbin/sugote-mksh", F_OK <unfinished ...>
28352 access("/data/local/xbin/su", F_OK <unfinished ...>
28352 access("/system/app/Superuser.apk", F_OK <unfinished ...>
28352 access("/data/app-lib/org.projectvoodoo.otarootkeeper-1", F_OK <unfinished ...>
28352 access("/system/xbin/su", F_OK <unfinished ...>
28352 access("/system/lib64/libsupol.so", F_OK <unfinished ...>
28352 access("/data/dcata/com.jrummy.busybox.installer", F_OK <unfinished ...>
28352 access("/dev/null", F_OK <unfinished ...>
28352 access("/data/data/com.saurik.substrate/lib/libSubstrateRun.so", F_OK <unfinished ...>
28352 access("/system/etc/init.d/99SuperSUDaemon", F_OK <unfinished ...>
28352 access("/system/bin/toolbox", F_OK <unfinished ...>
28352 access("/data/data/com.amphoras.hidemyroot", F_OK <unfinished ...>
28352 access("/system/bin/ls", F_OK <unfinished ...>
28352 access("/data/data/com.ramdroid.appquarantinepro", F_OK <unfinished ...>
28352 access("/data/data/com.noshufou.android.su.elite", F_OK <unfinished ...>
28352 access("/data/app-lib/com.RootBackupKeeper13_3-1", F_OK <unfinished ...>
28352 access("/data/data/com.saurik.substrate/lib/libAndroidLoader.so", F_OK <unfinished ...>
28352 access("/system/xbin/daemonsu", F_OK <unfinished ...>
28352 access("/dev/com.thirdparty.superuser.daemon", F_OK <unfinished ...>
28352 access("/data/app-lib/com.jrummy.busybox.installer-1", F_OK <unfinished ...>
28352 access("/system/xbin/suhappy", F_OK <unfinished ...>
28352 access("/data/data/de.robv.android.xposed.installer", F_OK <unfinished ...>
28352 access("/data/app-lib/com.formyhm.hideroot-1", F_OK <unfinished ...>
28352 access("/data/app-lib/com.troy1103.hideyourroot-1", F_OK <unfinished ...>
28352 access("/data/app-lib/sa.root.toolkit-1", F_OK <unfinished ...>
28352 access("/data/data/com.amphoras.hidemyrootadfree", F_OK <unfinished ...>
28352 access("/dev/com.koushikdutta.superuser.daemon", F_OK <unfinished ...>
28352 access("/dev/com.mypackagename.superuser.daemon", F_OK <unfinished ...>
28352 access("/system/xbin/amphoras", F_OK <unfinished ...>
28352 access("/data/app/org.projectvoodoo.otarootkeeper-1.apk", F_OK <unfinished ...>
28352 access("/data/data/com.saurik.substrate/lib/libsubstrate-dvm.so", F_OK) = -1 ENOENT (No such f
ile or directory)
28352 access("/magisk", F_OK <unfinished ...>
28352 access("/data/data/com.koushikdutta.superuser", F_OK <unfinished ...>
28352 access("/data/data/com.devadvance.rootcloakplus", F_OK <unfinished ...>
28352 access("/system/xbin/sugote", F_OK <unfinished ...>
28352 access("/system/etc/.installed_su_daemon", F_OK <unfinished ...>
28352 access("/dev/com.koushikdutta.superuser.daemon/server", F_OK <unfinished ...>
28352 access("/data/app/com.RootBackupKeeper13_3-1.apk", F_OK <unfinished ...>
28352 access("/data/app/stericson.busybox-2.apk", F_OK <unfinished ...>
28352 access("/.subackup", F_OK <unfinished ...>
28352 access("/system/lib/libsupol.so", F_OK <unfinished ...>
28352 access("/data/local/bin/su", F_OK <unfinished ...>
28352 access("/data/local/su", F_OK <unfinished ...>
28352 access("/system/bin/su", F_OK) = -1 ENOENT (No such file or directory)
28352 access("/system/usr/we-need-root/su", F_OK <unfinished ...>
28352 access("/system/bin/failsafe/su", F_OK <unfinished ...>
28352 access("/su/bin/su", F_OK <unfinished ...>
28352 access("/data/app/net.snclab.RootKeepSurvival-1.apk", F_OK <unfinished ...>
28352 access("/system/bin/app_process64_original", F_OK <unfinished ...>
28352 access("/data/data/com.saurik.substrate/lib/libAndroidCydia.cy.so", F_OK <unfinished ...>
22408 access("/data/data/com.ramdroid.appquarantinepro", F_OK) = -1 ENOENT (No such file or director
y)
22408 access("/data/data/com.saurik.substrate", F_OK <unfinished ...>
22408 access("/data/app-lib/net.snclab.RootKeepSurvival-1", F_OK) = -1 ENOENT (No such file or direc
tory)
22408 access("/system/xbin/su", F_OK) = -1 ENOENT (No such file or directory)
22408 access("/system/lib/libsubstrate-dvm.so", F_OK) = -1 ENOENT (No such file or directory)
22408 access("/dev/com.thirdparty.superuser.daemon", F_OK) = -1 ENOENT (No such file or directory)
22408 access("/data/data/com.koushikdutta.superuser", F_OK <unfinished ...>
22408 access("/data/app-lib/com.RootBackupKeeper13_3-1", F_OK <unfinished ...>
22408 access("/system/xbin/supolicy", F_OK <unfinished ...>
22408 access("/data/data/sa.root.toolkit", F_OK <unfinished ...>
22408 access("/data/data/com.mypackagename.superuser", F_OK <unfinished ...>
22408 access("/data/app/org.projectvoodoo.otarootkeeper-1.apk", F_OK <unfinished ...>
22408 access("/data/data/com.saurik.substrate/lib/libDalvikLoader.cy.so", F_OK <unfinished ...>
22408 access("/sbin/su", F_OK <unfinished ...>
22408 access("/system/etc/.installed_su_daemon", F_OK) = -1 ENOENT (No such file or directory)
herolte:/ #