[Magisk] topjohnwu:
Some Words On Tamper Detections

My previous post seems to cause some confusion, what happened is that Google made the detection even stricter, and I fixed it.

There is currently no builds available yet for you to bypass the new policies, the purpose of that post is to want you to stay calm, don't panic, acknowledge you that the situation in still under my control, and please wait for the next beta to come :)

Also to be honest, I personally think there really is no effective method to prevent magiskhide to work, unless there exist some ways that's beyond my knowledge; they add more checks, and I hide more.

Since Magisk is running as root but the SafetyNet checks are not, we are more privileged than the detection method, and as a result we have MUCH more control over what the SN process can see.

(Edit addition: Another way to effectively prevent Magisk to work is what Google has done to their Pixel devices - they make it a hell difficult to even patch the boot image, or add some hardware/bootloader level checks. Recent Pixel devices are going in a direction that's very crazy, no ramdisk, hiding fstab into dtb, force signature requirements.......)

The only thing I currently cannot come up with a good way to hide is the application: Magisk Manager. Some apps already start detecting whether "com.topjohnwu.magisk" is installed, and for some freakin reason Android allows any app to know what other apps a user have installed (where's the privacy man?), and there is no permission switch to turn this off.

However, apps using this detection method is quite stupid, since we can change a package name very easily. Also, the fact that the application is installed doesn't imply your device is tampered by any means: any non rooted device can install the app, and the flawed detection method will pull a false alarm and refuse to run on these unrooted device. Google's SafetyNet on the other hand does not use such low-end detection method, but instead it checks whether the device is actually tampered, which is much more reasonable.

Despite the fact that this particular detection method is stupid, it is actually quite effective lol. Changing package names are not "actual" solutions, since it will just go through the unended "cat-and-mouse" situation. Possible real solutions are injecting code into PackageManager to filter out Magisk Manager from the installed package list, which either requires Xposed (but well, Xposed itself will break SN, and also there is no Xposed for newer Android versions), or directly patch the framework's Java code (maybe some similar approaches like the "notorious warez" by patching oat/dex files)

Chainfire's suhide was able to hide package names at that time because it hijacks even deeper stuffs - replacing standard native library functions with its own. That's a bit beyond my knowledge, and also I think Google already prevents the hijacks in one of the security patches. The nice thing about MagiskHide is that it hides things externally, and doesn't hijack code within your device.

So my main goal is always just to focus on one single target: the most used SafetyNet check. I might look into other detection methods some time, but not now.