yashsingh1/xdaforums huggingface dataset:
[Magisk] Ingan121:
I've just found out that BB apps detect Magisk by using new method, not the UDS one.

(Thankfully, there is a free trial for BB UEM.)
[Magisk] paarnoutse:
For my company I've to use BB Work, BB Access and - optionally - BB Work Tasks, but no need to install or use the BB UEM Client.

With Magisk Manager hided (random package name) and obviously the installed BB apps being hided, the latest versions of the BB apps are detecting root. The 'UDS detection prevention' trick doesn't help, nor disabling 'USB debugging' nor disabling 'OEM unlocking' in Developer options.

Just encountered in some previous posts here the tip to hide also the system app 'Work profile setup' (com.android.managedprovisioning).

Question regarding 'Work profile setup' hiding:

Does anyone know whether hiding 'Work profile setup' also makes sense in case the BB UEM Client isn't required by your company for using the BB apps?

Nb.

Although it would be easy to just add it to my hidelist and then retry the BB app upgrades again, when it still detects root afterwards I've to 'downgrade' the apps once more, incl. a next unlock or even a container wipe & re-enroll request (after already being required to do that many times after my previous tryings to find a root detection bypass, while I was told that after too many unlock and/or re-enroll request your device may be get blocked permanently).
[Magisk] whitebait:
I only have BB Work installed and have the work profile setup hidden but this doesn't work with the latest version of BB Work. In that it still detects root with this hidden.

I'm getting intermittent issues with Webview implementation on the older version 2.17.0.1169 so it'd be good to work out how the newer version(s) are detecting root and get upgraded.

Anyone got any ideas how the newer version is detecting root?
[Magisk] Manan79:
Same issue...safetypatch doesn't work with latest bb work app
[Magisk] lightspeedx:
I was using BB Work with Magisk where I hid BB Work and it worked until 3 days ago when it no longer worked. Is BB Work detecting Safetynet? If not, what is it deteching? I really need to get BB Work to work on my Android :( Any suggestions?
[Magisk] paarnoutse:
Root detection by latest versions of BB Work (v2.18) doesn't seem to be related to SafetyNet checking. At my device SafetyNet tests are OK, and BB Work v2.17 doesn't detect root (requirements: BB Work is in your hidelist *and* Magisk Manager is hided [random package name]).

However, after upgrading BB Work to v2.18 it now detects that the device is rooted (while SafetyNet check is still OK).

BB Work v2.18 appears to have implemented some new method to detect root, but not being related to SafetyNet checking, nor 'UDS detection prevention', nor 'USB debugging' or 'OEM unlocking' options being enabled.

As far as I know, reverting to BB Work v2.17 is the only available method at the moment to get is working again... :(
[Magisk] lightspeedx:
What about BB Access and BB Connect? Do they also need to be of an older version?
[Magisk] lightspeedx:
I downloaded BB Work v2.17 and it seemed like it went through policy checking but then the app wouldn't startup. It would revert back to the same Email/Access Key screen repeatedly. On my company's BB management site, it allows for self-generation of Access Keys. I would generate and use different Access Keys and it would go through the policy check sequence again and then flip back to the Email/Access Key screen. It won't seem to let me go beyond this screen. The only "good news" is it isn't saying that my Android is jailbroken. The latest version of BB Work (v2.18) would flash that ugly jailbroken warning screen at me after policy checks.

1) Have any of you experienced the same situation as me?

2) Do you have any other ideas to try? Is there any way at all to get BB Work to work with Magisk? I have a custom ROM on my Android. BB Work v2.18 would say it's jailbroken even when I had unrooted and uninstalled Magisk.

Please help! Thanks much!!!

---------- Post added at 01:02 AM ---------- Previous post was at 12:50 AM ----------

What happens when you use the latest Magisk which is Magisk 19.3 and Magisk Manager 7.3.2?
[Magisk] paarnoutse:
Same root detection problems as in 'BlackBerry Work' 2.18 also occur for the recent versions of 'BlackBerry Access' and 'BlackBerry Work Tasks'.

For 'BlackBerry Work' and 'BlackBerry Work Tasks', v2.17 is OK but v2.18 detects root.

For 'BlackBerry Access', v2.11 is OK but v2.12 detects root.

I don't know status for 'BlackBerry Connect', because for my company it's not needed to have it installed.

---------- Post added at 11:03 AM ---------- Previous post was at 10:27 AM ----------

I had similar problems after reverting to BB Work 2.17 (after an upgrade to BB Work 2.18 detected root).

Your device may be set to 'jailbroken' status at your company BB admin, or that status may still be saved somewhere in the app data of (one or more of) the BlackBerry apps, or in cache.

To be sure that no traces were left, I performed following steps and all was OK again afterwards:

- Un-enroll the device at the company BB admin website

- Uninstall all BB apps (Work, Access, etc.)

- Reboot in recovery mode and clear cache

- Reboot system and restore from Titanium Backup the BB apps only (not their data!), eg. BB Work 2.17, BB Access 2.11, etc.

- Hide them in Magisk

- Re-enroll the device at the company BB admin website

Obviously you've to set auto-update OFF in your PlayStore settings, to prevent that root detection will re-appear after an auto-upgrade of the BB apps by PlayStore.
[Magisk] lightspeedx:
I tried the steps you have outlined below. BB Work refuses to start up. It loops back to the Email/Access Key screen. It could be that Magisk is not sufficiently hiding it from detection or could it be that my BB Admin has set it to where only the latest BB Work app?

Any thoughts on what else I can do?
[Magisk] paarnoutse:
After reïnstalling BB Work (and hiding it in Magisk), at first open after re-enrolling your device you obviously have to reconfigure its setup. Indeed, as first questions it will ask your email address, and an Access Key. Specify the Access Key that should have been generated and shown at your company's BB admin website at the moment you re-enrolled your device just before (assuming you un-enrolled your device - as was described - before).

Perform same steps and details (except another Access Key) as what you did when you installed BB Work and registered your device for the first time.

Exact steps and details to setup BB Work varies per company, but I guess your company has a user guide to setup BB Work for their usage, including all required and exact details that have to be specified (incl. Domain, Server, etc.)?
[Magisk] lightspeedx:
My company offers a self service BB access key generation tool. So in theory I can keep generating new ones and I have for these tests. Despite entering new access keys, the BB Work app won't let me through. It would refresh and take me back to the email/access key screen. The only good thing to using the older BB Work app is it now doesn't say I have a jailbroken device. Everything else remains where I still have no access.
[Magisk] paarnoutse:
For BB admin just generating a next Access Key for a specific BB app (eg. BB Work) which was already installed before at an earlier enrolled device, is NOT the same as un-enrolling your device (at my company's BB admin website by selecting 'Wipe the container') and then getting a new Access Key by a new 'Enroll your device' request.

Did you really un-enroll your device, and later generate an Access Key by re-enrolling your device again?

If not, your access may still be blocked - even when now being reverted to BB Work 2.17 - because it may be recognized as a request for the originally enrolled device that was marked as being jailbroken at the moment of your earlier upgrade to BB Work 2.18.

That's why I performed all the steps as described before, which made it all running OK again for me with previous BB app versions at same physical device (but processed by BB admin as new device because of the un-enrollment before).
[Magisk] lightspeedx:
Yes, I had unenrolled and deleted my device off the BB Admin site (through self-service capabilities). After unenrolling and deleting, I then generated a new access key. It would still take me back to the email/access key site after going through policy check.
[Magisk] paarnoutse:
Then unfortunately I don't know what could be the reason for your issues nor how it could be resolved, sorry... :(
[Magisk] andrewwdai:
Right now, with some tweaks GPay can be made with root. If this BlackBerry Work root check extends there, there shall be no way we can use GPay anymore. I tried 2.17 version but nope, wont work.
[Magisk] paarnoutse:
Could you plse explain what you wanted to report here regarding the root detection by BlackBerry work since v2.18, while v2.17 works OK? Do you suggest any relationship between GPay detecting root and the root detection as may be exploited by BlackBerry Work since v2.18?

If at your device BlackBerry Work v2.17 also detects root (as I interpreted your last sentence), then I guess we're talking about different subjects. As far as I know, BlackBerry Work up to v2.18 runs OK for anyone, assuming that (in addition to hiding BB Work itself) also Magisk Manager is hided (random package name), and Chainefire's LifeBoot isn't installed.

Thanks in advance for your explanation!
[Magisk] andrewwdai:
I am just saying that Blackberry has some misterious ways of detecting root. GPay has not got to that point, yet. Otherwise we wont be able to use GPay with rooted device. 2.17 was ok until I updated yo 2.18. But once detected, it left traces somewhere (also a mystery) that reverting back to 2.17 wont help getting pass detection.
[Magisk] darknessy:
Where are you getting older ver of BB Access from? I cant find it on apkmirror
[Magisk] paarnoutse:
Although in my opinion the current method of root detection by GPay has nothing to do with the root detection method as exploited now in the recent versions of the BlackBerry apps, it's true that once root was detected by v2.18 just reverting to v2.17 may not be sufficient to get it working again ("traces left", as you name it).

At my device I got v2.17 working again as descibed here: https://xdaforums.com/showpost.php?p=80018039&postcount=53

(which obviously does not guarantee that this method offers a solution for everyone...)
[Magisk] paarnoutse:
I made the older versions (not yet detecting root) of 'BlackBerry Access', 'BlackBerry Work' and 'BlackBerry Work Tasks' public available for download at the links below:

- BlackBerry Access 2.11.1.1419-arm

- BlackBerry Work 2.17.0.1169

- BlackBerry Work Tasks 2.17.0.2353

To prevent root detection by these versions, you just need to add them to your Magisk hidelist, and hide Magisk Manager itself (random package name - See Magisk Manager / Settings).

Nb.

Previous versions (that doesn't yet detect root) for some other BlackBerry apps (eg. 'BlackBerry Connect') can be found in https://www.apkmirror.com/
[Magisk] andrewwdai:
I actually followed this but no luck. Given this cat and mouse game, I am carrying a spare phone with bootloader locked to check company email and use GPay. lol![emoji15]
[Magisk] iaTa:
As suggested I installed BB UEM Client 12.34.0.155244 and BB Work 2.17.0.1169.

I also changed the Magisk Manager package name from within Magisk Manager settings and ensured both BB apps were set to hide under Magisk Hide.

Using Chrome or Android System WebView 75.0.3770.143 or below and everything works perfectly.

If I update Chrome or WebView to the latest version I see a webpage error in BB Work when viewing emails but at least there is a working solution for now.

I then edited the detach script included with YouTube Vanced Magisk module to detach BB UEM, Work and Chrome from the PlayStore to ensure they don't get updated automatically/accidentally:

File:

/common/post-fs-data.sh

Line 75:

CHECK=`./sqlite /data/data/com.android.vending/databases/library.db "SELECT doc_id FROM ownership WHERE doc_id = '$PKGNAME' or doc_id = 'com.good.gcs' or doc_id = 'com.rim.mobilefusion.client' or doc_id = 'com.google.android.webview'";`

Line 92:

./sqlite $PLAY_DB_DIR/library.db "DELETE from ownership where doc_id = '$PKGNAME' or doc_id = 'com.good.gcs' or doc_id = 'com.rim.mobilefusion.client' or doc_id = 'com.google.android.webview'";

Line 93:

./sqlite $PLAY_DB_DIR/localappstate.db "DELETE from appstate where package_name = '$PKGNAME' or package_name = 'com.good.gcs' or package_name = 'com.rim.mobilefusion.client' or package_name = 'com.google.android.webview'";

If you are using Chrome instead of WebView change 'com.google.android.webview' on each line to 'com.android.chrome'.

Hopefully someone figures out how the latest versions of the BB apps are detecting root so that detaching from the Play Store is not necessary and we can use the latest WebView.
[Magisk] paarnoutse:
Thanks! :good:

I didn't realize that the webpage error when opening an email in BB Work (I'm still using BB Work v2.17 due to root detection in v2.18) was caused by the recent WebView upgrades (either WebView as part of Google Chrome when Chrome is your default browser, or the standalone Android System WebView package when Chrome is disabled and you're using an alternate browser).

For people - like me - that aren't using YouTube Vanced Magisk: Following actions can be used to prevent auto-update of *specific* apps (as alternate to disabling auto-update for *all* apps in Play Store / Settings). Do this for Google Chrome, for Android System WebView, and for the BlackBerry apps itself:

- Open Play Store app

- Select 'My apps & games'

- Select the 'INSTALLED' tab

- Scroll down and select the app for which you want to disable auto-update

- Click the 3-dots icon in upper right corner

- *uncheck* the option 'Enable auto-update'

Just installing a lower Chrome version while the active version is higher, doesn't work. Therefore, to downgrade Google Chrome (incl. its built-in WebView) I used following steps:

- Download Google Chrome 74.3729.136 from apkmirror.com (select the correct variant for your device!)

- Backup Google Chrome with Titanium Backup

- In Play Store app browse to Google Chrome and select UNINSTALL

- Confirm the message: 'Do you want to uninstall all updates to this Android system app?'

Nb. It appeared that this *also* uninstalled the updates of the standalone Android System WebView package.

- Install the downloaded Google Chrome 74.3729.136 apk

- Using Titanium Backup, restore *ONLY* the DATA of the Google Chrome backup as made just before.

- Reboot

After these steps all was OK again, and emails in BB Work readable as before.
[Magisk] iaTa:
If you disable Chrome and re-enable it should be downgraded to your stock ROM version, same with WebView.

The problem with unchecking auto-update is the Play Store will randomly override that option and upgrade the app.
[Magisk] paarnoutse:
Yes, disabling Chrome and then re-enabling seems to have same effect as just uninstalling, so the choice between two actions or one action ;)

EDIT:

My originally posted alternate 'solution' here for auto-update handling (disable auto-update in the general Play Store settings, and enable it at individual app-level for the ones that you really want to be auto-updated) isn't possible [anymore].

See next post; Thanks iaTa!

Indeed it appeared that as soon as you disable auto-update in the general Play Store settings, you can't enable it for individual apps. I didn't realise that, because I don't want auto-updates to be applied at all. This just because it gives me the opportunity to have a quick look at the described updates and/or added features for any app before I then manually select them for actually being updated.
[Magisk] iaTa:
This has never been possible for me on any Android device.

If the main Play Store setting for auto update is disabled, when I try to enable auto update for individual apps it will only allow me to if I re-enable the main Play Store auto update setting.
[Magisk] napes22:
I can't get this to work. I'm on an AOSP ROM where Chrome is not a system app. I've uninstalled, cleared all data, and installed the new Chrome. I've also tried using your approach above and it doesn't seem to work. All emails give me a webpage not available error. Any idea on how to make this work? I'm also using Kiwi Browser, not sure if that could cause an issue since it's chrome based.

For now I'll have to go unrooted, until this is worked out by a future version of Magisk. Can we report this to the Magisk Dev to look into?
[Magisk] iaTa:
Have you changed the system webview to use Chrome in developer options?
[Magisk] iaTa:
I've tested all of the latest versions of Chrome/WebView and 75.0.3770.143 is the most recent version that works correctly with BB Work 2.17.0.1169.
[Magisk] paarnoutse:
Due to root detection by more recent versions, I'm still running BlackBerry Work 2.17.0.1169, and in addition (to prevent 'Webpage not available' errors when opening an email in BB Work 2.17) also the old Chrome & WebView 75.0.3770.143 version. This was working OK, until today... :(

Unfortunately, BlackBerry seems to have found a next method in trying to enforce users to upgrade BB Work. Although BB Work (+ my other BB apps) and Chrome/WebView are still these same older versions, the error when opening emails in BB Work now appears *even* with the older Chrome/WebView version!

I am tired of all the hassle with BlackBerry Work. Until a workaround is found for root detection by the recent BB app versions, I will uninstall my BlackBerry apps for the moment, and start to access my work email via OWA in a browser (https://outlook.office365.com/owa/).

As a result no notifications anymore for new emails, but for work mails I doubt whether that's a real disadvantage outside office hours ;) (during office hours I get new email notifications at my work laptop anyhow...).
[Magisk] iaTa:
Still works fine for me.
[Magisk] iaTa:
Upgraded my OP7 Pro to Android Q and BB Work 2.17 is not supported and fails to login.

The latest BB Work supports Q but as we know it detects root even using Magisk Canary.

Hopefully someone figures out how BB Work is detecting root.
[Magisk] Neff_V:
Really Strange Guys. Newest Android 10 on my Pixel 2 XL and BB Works, Access and Tasks are working great with Magisk-Hide.
[Magisk] iaTa:
Did you install and configure on P and then upgrade to Q? Also are you running the latest versions of the apps?
[Magisk] Neff_V:
Nope. I was on Q Beta the first time when I configured my Profile. Yes, latest versions.

Work - 2.19.0.1304

Access - 2.12.2.1451-arm64

Tasks - 2.19.0.2603
[Magisk] firstblud:
Is your chrome up to date too?
[Magisk] Neff_V:
Yes, Chrome Beta Version 77.0.3865.66.
[Magisk] napes22:
Until we're able to figure out a new work around I'm going to have to use my phone non-rooted. I need to have access and I can't use the Office365 portal.
[Magisk] iaTa:
And did you initially configure your profile before or after installing Magisk?
[Magisk] Neff_V:
After I installed magisk.
[Magisk] iaTa:
Just tried everything again from scratch. Installed latest Magisk Canary, enabled Magisk Hide for BB Work, select Hide Magisk Manager and then setup BB Work using access key and it worked!

Also no need to keep old versions of WebView/Chrome installed as using the latest version of BB Work.

Perfect.
[Magisk] Red_Acid:
But are you running Android Q/10? Or will it work on Android P?
[Magisk] iaTa:
I'm running a OnePlus 7 Pro on Q OB1.

Not sure if it works on P, give it a go!

Just to confirm I only have BB Work installed, no UEM client.
[Magisk] Ingan121:
Did you activate BB Dynamics? When I tested with BB UEM, the UEM client itself didn't detect Magisk, but when I tried to activate Dynamics, it says device id jailbroken and the device is marked as rooted in device list in admin tool.

(Not sure for BB Work, but it is likely that it has a harder root detection by libgdndk.so.)
[Magisk] iaTa:
I only have BB Work installed. I used BB Access on my laptop to generate an access key (http://go/uem), logged in to BB Work and entered email along with access key.

You must ensure that you select the 'Hide Magisk Manager' option in Magisk settings.
[Magisk] andrewwdai:
I am on Q, and my first try failed. Only after I flashed a custom kernel which hides the unlocked bootloader, it worked.
[Magisk] paarnoutse:
My OnePlus 5 is also still running Q (OxygenOS 5.1.7, being Android 8.1.0). I just installed Franco Kernel (I used stock kernel before), and after reboot I upgrade BB Work from v2.17 to 2.18.

Unfortunately, after opening it immediately detects root.

(yes, my Magisk Manager is hided, and BB Work is in my hide list).

Also retried completely ' fresh':

- Uninstall the BB apps

- Un-enroll my device

- Clear Dalvik Cache (+ PlayStore & PlayServices data)

- Add BB Work to hidelist (before re-install) via command:

magiskhide --add com.good.gcs

- Reboot

- Re-enroll device

- Install BB Work 2.19

After opening it detects root.

Just switching from stock kernel to a custom kernel (to hide unlocked bootloader) doesn't seem to be sufficient in all cases. May be it also requires one of the most recent Magisk versions, and it possibly only works at the moment with current Magisk Canary version (I didn't try that yet).
[Magisk] andrewwdai:
I am not familiar with OxygenOS, but Q is Android 10....

None of the BB versions work on Pie (Android 9) anymore, regardless what I tried. It is funny coz usually you go back to older version and it might work, lol.
[Magisk] paarnoutse:
Oops, sorry for my misreading 'O' versus 'Q' Android version. Time for new glasses...

Thanks for the very useful info, based upon your experiences, that:

a) Root detection by BB Work disappeared after flashing a custom kernel which hides the unlocked bootloader, and

b) Preventing the root detection using that bypass only seems to help for BB Work running at Q (10), not at Pie (nor Oreo).

Nb.

For me, still at Oreo, the old versions (eg. BB Work 2.17) don't detect root. However, opening an email always shows an error so contents can't be viewed. The latter could be bypassed by running an older Chrome/WebView version, but since about 2 weeks ago that doesn't help anymore for me (but seems still to work for other people, don't know why).
[Magisk] andrewwdai:
This is a game of cat and mouse, so having fingers crossed when there is an update.
[Magisk] whitebait:
I'm on latest Pie beta on OP5T and BB work v2.17 with Chrome v74.0.3729.136 works for me.

That's with latest Magisk Canary build, Magisk Manager hidden, Magisk Hide on and all BB work related apps have root hidden from them.

Pleased to hear it seems to work on Q for most people, but it'd be good to understand why it does. Does Q change/limit what apps can see of their environment? Is Q stopping BB Work from using a certain method to check for root?
[Magisk] napes22:
Much agreed. The issue is that I don't think Magisk or ROM developers really care about Blackberry work, they focus more on Google Pay, Chase Pay etc. So I'm hoping newer versions of Canary have a better way to hide itself. For now I'm running unrooted, but once I upgrade to Q I'm going to want to root again (assuming the root eventually works for Polaris devices).
[Magisk] karmak:
Pixel 3 XL

Android 10 (QP1A.190711.019)

Magisk - 19.4 (Canery)

BBFW (Black Berry for Work) - 2.17.1169

After installing the latest Magisk and getting tethering to work BBFW detected root and wiped my (says device) app. I could not get it to work again for anything. In Magisk I went to settings and the 4th option down I do not recall what it said (says Restore Magisk Manager with original package now) but something along the lines of renaming the app. Once I clicked on that it downloaded something and took me back to the Magisk home screen. I went back to BBFW, generated a new code and it all works as it did on Android 9. Hope this helps someone. The last step I missed after upgrading and it did the trick.
[Magisk] yxd0018:
android 9 pie aex rom. Bootloader is not locked. Magisk hide given and manager hidden.

Need to DOWNGRADE BBFW to 2.17 to be able to bypass it.

For connect, access, I use 2018 Jan-Apr version, works great.