[Magisk] rockingondrums:
Also on Magisk 17 on Pixel 2 XL with Pie. Samsung Pay is definitely checking something locally on the device that is not protected with Hide.

BTW, there is a very obvious log file placed on the root of the SD card when you open S Pay with root. I can't make sense of it, but I'll provide my log and I encourage others to do the same. Hopefully, someone knowledgeable can figure it out.

​<Information>
com.samsung.android.samsungpay.gear
/data/app/com.samsung.android.samsungpay.gear-dG2A-SJAD3sFQ_ugrfNjFQ==/base.apk
/data/app/com.samsung.android.samsungpay.gear-dG2A-SJAD3sFQ_​​ugrfNjFQ==/lib/arm
/data/user/0/com.samsung.android.samsungpay.gear
61e271191b2ea44e
armeabi-v7a
Pixel 2 XL
28
</Information>

<Detection>
Date Time Source Policy Summary Current Warning Ver Name Description
2018-09-12 22:06:37 [6042] 52355100 00004000 00004000 00004000 4.4.4 (ROOTED ) MAGISK
2018-09-12 22:06:37 [6043] 52355100 00006000 00002000 4.4.4 (ROOTABLE ) MAGISK
2018-09-12 22:06:37 [6041] 52355100 02006000 02000000 02000000 4.4.4 (RSH ) MAGISK
2018-09-12 22:08:13 [6042] 52355100 00004000 00004000 00004000 4.4.4 (ROOTED ) MAGISK
2018-09-12 22:08:13 [6043] 52355100 00006000 00002000 4.4.4 (ROOTABLE ) MAGISK
2018-09-12 22:08:13 [6041] 52355100 02006000 02000000 02000000 4.4.4 (RSH ) MAGISK
2018-09-12 22:11:03 [6042] 52355100 00004000 00004000 00004000 4.4.4 (ROOTED ) MAGISK
2018-09-12 22:11:03 [6043] 52355100 00006000 00002000 4.4.4 (ROOTABLE ) MAGISK
2018-09-12 22:11:03 [6041] 52355100 02006000 02000000 02000000 4.4.4 (RSH ) MAGISK
2018-09-12 22:15:19 [6042] 52355100 00004000 00004000 00004000 4.4.4 (ROOTED ) MAGISK
2018-09-12 22:15:19 [6043] 52355100 00006000 00002000 4.4.4 (ROOTABLE ) MAGISK
2018-09-12 22:15:19 [6041] 52355100 02006000 02000000 02000000 4.4.4 (RSH ) MAGISK
2018-09-13 10:09:18 [6042] 52355100 00004000 00004000 00004000 4.4.4 (ROOTED ) MAGISK
2018-09-13 10:09:18 [6043] 52355100 00006000 00002000 4.4.4 (ROOTABLE ) MAGISK
2018-09-13 10:09:18 [6041] 52355100 02006000 02000000 02000000 4.4.4 (RSH ) MAGISK
2018-09-13 14:27:43 [6042] 52355100 00004000 00004000 00004000 4.4.4 (ROOTED ) MAGISK
2018-09-13 14:27:43 [6043] 52355100 00006000 00002000 4.4.4 (ROOTABLE ) MAGISK
2018-09-13 14:27:43 [6041] 52355100 02006000 02000000 02000000 4.4.4 (RSH ) MAGISK
2018-09-13 14:34:52 [6042] 52355100 00004000 00004000 00004000 4.4.4 (ROOTED ) MAGISK
2018-09-13 14:34:52 [6043] 52355100 00006000 00002000 4.4.4 (ROOTABLE ) MAGISK
2018-09-13 14:34:52 [6041] 52355100 02006000 02000000 02000000 4.4.4 (RSH ) MAGISK
2018-09-13 14:35:25 [6042] 52355100 00004000 00004000 00004000 4.4.4 (ROOTED ) MAGISK
2018-09-13 14:35:25 [6043] 52355100 00006000 00002000 4.4.4 (ROOTABLE ) MAGISK
2018-09-13 14:35:25 [6041] 52355100 02006000 02000000 02000000 4.4.4 (RSH ) MAGISK
</Detection>

<Processes>
Pid Uid PPid ProcessName
9079 10285 9036 zlxkutk
9036 10285 755 com.samsung.android.samsungpay.gear
</Processes>

<Maps>
Address Perm Offset Dev Inode Pathname
12c00000-52c00000 rw-p 00000000 00:05 29023 /dev/ashmem/dalvik-main space (region space) (deleted)

(((((((((((((( There are thousands of more lines in this section that are too large for an XDA post ))))))))))))))

</Unix>

{fcd6cfbb}

Talking out of my rear end, I'm suspicious of that first PID. Again, I have no idea what I'm talking about.