yashsingh1/xdaforums huggingface dataset:
[Magisk] LenAsh:
Well... that worked! Survived a reboot too. I dare say the server-side code will be "fixed" soon though.

The Build you grabbed appears to be a version created by the ROM Developer, so not sure what he/she did...
[Magisk] dj_sploits:
I've messaged the ROM creator asking if it's OK to share the Magisk zip file (maybe should of done that first......)

Hopefully they'll be fine with it
[Magisk] LenAsh:
Both Magisk and the ROM are Open Source, by definition and in the spirit of XDA.

However, it's always good form to let the creator know, and provide due credit when their work is used as-is or re-based.

Edit your post with the original link in it with a credit...
[Magisk] dj_sploits:
Sorted. Posted edited and credit given. I had a private message to say it was OK to distribute the zip file.

All rosey ☺
[Magisk] LenAsh:
Well played. I suppose the question is, what did he/she do to compile a version that worked when all others don't? It isn't a Samsung only version, I have a Mi A1...

The question is rhetorical... I'm sure some of the good folk hereabouts will solve the mystery with aplomb.
[Magisk] anttaz:
Will the device provide the changes for what he did?
[Magisk] metrize:
Same problem. Safety net passes.

Even with the 16.7.2 posted above. Suddenly happened now...
[Magisk] sterlingserling:
I think it might be a problem with the update of the app itself. Ive been having it force close immediately after opening since the latest update so I found the previous version's apk and it opened fine but won't login because the version isn't supported anymore, but no force close. Then I filtered reviews of the app on the Play Store by latest version only and it seems like everyone is complaining about the same problem which makes me think it has nothing to do with Magisk. I've only had Santander for a few months but it lve already noticed that they seem to have a lot of issues when it comes IT related stuff. I just keep checking for the next update
[Magisk] LenAsh:
It's just failed on me too... it worked all day and then failed. Damn.
[Magisk] dj_sploits:
Strange, it's still working for me....... Well for now at least ?
[Magisk] LenAsh:
Interestingly, my other Mi A1 running Lineage works just fine with Santander. No Magisk on that...
[Magisk] dead0:
Ive noticed if kernel selinux is enforcing then magisk hide seems to work with the Santander app
[Magisk] freezoid:
I got custom Android 7.1.2 ROM.

Santander app works fine without Magisk, otherwise I'm getting root warning.

I'm passing safety net and rootbeer. Device is certified in play store. Tried hiding bank app, phone app + services. Tried hiding Magisk manager as well. Magisk 16.7.2 didn't change anything. No luck with Magiskhide Props Config too.

I've cleaned Santander's data, reinstalled it and rebooted countless times between all above tries.

Did I miss anything or it's impossible to make it work for now?

Thanks
[Magisk] moe7863:
Still no Santander app for me

I tried this version and got stuck in a boot loop but thankfully got out of the boot loop by installing the previous version of Magisk from TWRP. Still no Santander for me :(
[Magisk] Divyas:
Having the same problem with Santander and Halifax, funnily enough the app which goes out of its way to detect magisk manager (Barclays) is still working.

I've asked for help in the Beta Magisk thread and none of the suggested methods have worked which includes magisk core only mode, installing Magisk_Hide_Props_Config module and searching the logcat for any subprocesses that can be manually added to magisk hide.

Going to try Magisk 16.7.2 and hope.

edit: Nope does not work for either Santander or Halifax. I really want to know how they achieved this without an app update this is driving me nuts.
[Magisk] moe7863:
Magisk 16.7.2

Hi

Did Magisk 16.7.2 work for you? Apparently some people have had success with it but unfortunately I haven't. I hope someone finds a way around this! :(

Thanks
[Magisk] Zentachi:
I have exactly the same problem. Halifax and Santander apps stopped working yesterday. Have tried also everything including using Magisk 16.7.2

Really curious of what they have done. Hope someone will figure it out soon :(

I am not sure if it is related/helpful while looking around to see what might the cause be I realized that "Device certification" section is not appearing in my Play Store Settings.
[Magisk] alpsayin:
Guy with ulefone armor 2, android 7.0, magisk 16.01 Permission13 branch here. Without an app update I now get this warning too. I had Titanium backups for which I used to restore. Even the previous versions were detecting. I'm suspecting remote code execution...

EDIT: it's definitely some kinda remote code download and execution because I was able to bypass root check in Santander UK app by disconnecting wifi+4g. But basically below steps allowed me to register my device again. Although once I logged out and tried to log in again it went wild. I'll leave this to you to test/expand my findings.

1. force stop and clear data of banking app

2. disconnect all internet connectivity

3. open banking app, wait until it complains about to connectivity. do not press ok nor cancel, leave the dialog.

4. re-enable connectivity from quicksettings without changing foreground app.

5. press retry, it's now asking for customer number

6. profit.

potiential permanent fix; find the host/url where root checking codes are fetched from and block/redirect it. also as a security note, if this indeed remote code execution, this is very unsecure as anyone can perform a mitm attack and execute code within the app, geez :|. anyways, i'm waiting on your findings more technical peeps :)

EDIT2: can someone dig deeper with a hotspot+wireshark setup to monitor requests when bank app is fired up?

EDIT3: yeah as soon as the banking app is gone (from memory), it re-downloads root checkin mechanism in the "securing your device" screen and complains about root.

---------- Post added at 07:20 PM ---------- Previous post was at 06:25 PM ----------

Sorry, false alarm it's not remote code execution it sends a list of apps you have and sends it off to probably compare it to a repo.

EDIT: sorry for the false alarm, there's no permanent fix yet.
[Magisk] LlamaLad7:
I've got an S7 Edge Exynos (SM-G935F) running LineageOS 15.1 and Magisk 16.0. The steps seem sensible, and the temporary fix works, but when I try and complete device registration after renaming the files, it goes back to the login screen. I type in my User ID, and it says there was an error. Any ideas? Thanks.
[Magisk] dead0:
I managed to get it working with the above steps but it was only temporary. After a few minutes, it stops working again with the root warning
[Magisk] Didgeridoohan:
[MENTION=2354885]alpsayin[/MENTION] Does it just send a list of all the apps you have installed? That'll be hard to circumvent... Uninstalling apps that use root until you find the culprit is one way.

An idea: Sandbox the Santander app so it can't see what apps you have installed. You could try using Island. It's still in beta, so be careful (it might mess up your device), but theoretically it should be able to stop the app sending of a list of your installed apps.
[Magisk] Pietolsen:
It may be the same issue that I had with the Danish NemID app, I was able to fix it with this solution. I don't have santander bank but I can download and run the app without root detection Magisk v16.0

https://xdaforums.com/showpost.php?p=77085031&postcount=21

It appears to be looking for the App name Magisk Manager.

Hope this might help if the issue persists.
[Magisk] sheyac:
The only app I have that would give away root is viper4android (obviously magisk as well but the app name is scrambled). I tried island and it didn't work, but I don't really know what I was doing.
[Magisk] Didgeridoohan:
You'll have differentiate between package name and app name. The Magisk Manager can randomise it's package name, but not yet the app name (it's a planned feature, no ETA). Many apps have started looking for "Magisk" in the app name... Easy to test by uninstalling the Manager.
[Magisk] alpsayin:
I tried this but no luck. It's all the same as before, I wonder triggers out this time. The app list doesn't have magisk but it does have island. Wonder that's the issue now...

As for the "permanent" fix; I was mistaken. Apologies to everyone

---------- Post added at 01:16 PM ---------- Previous post was at 01:14 PM ----------

Well, magisk is open source, maybe we can change the app name and recompile..
[Magisk] jeremysimons:
I think (and please correct me if I'm wrong?)

First you need to register without root on the device.

Then you need to follow these steps afterwards to stop the device from becoming unregistered with the bank.
[Magisk] Pietolsen:
This is exactly what I did, if you go to my post which I linked you can see how I got mine working. Haven't had a single issue since.
[Magisk] sheyac:
So you recompiled magisk with a different name and it worked?
[Magisk] Pietolsen:
Yes, although I myself don't have Santander bank or live in the UK so I cannot test it properly myself, however I was able to download the Santander UK banking app from the Play store, run it and it did not detect root access.
[Magisk] dead0:
Is your kernel set to permissive or enforcing?
[Magisk] Pietolsen:
Enforcing

*Edit*

I changed the kernel to permissive and it will now detect root upon running the app from a fresh install, however when launching it for the first time in enforcing and then charging it back to permissive it doesn't seem to detect it.

Sorry for not investigating enough before communicating possible solutions.
[Magisk] alpsayin:
I tried island and uninstalling magisk manager under enforced selinux. Still no luck with Santander.

I also went a bit beyond and tried xprivacy lua (installed system less xposed) to block Santander's app-list access, it just caused Santander to crash continuously.

I think something other than or in combination with app-list is triggering this, because there are files about genetic risk calculations.
[Magisk] dead0:
Keep magisk manager & use magisk hide with kernel enforcing & see if that works
[Magisk] sheyac:
How do you set kernel to enforcing while using Magisk?
[Magisk] alpsayin:
1. https://xdaforums.com/apps/magisk/module-magisk-selinux-manager-t3760042

2. https://f-droid.org/en/packages/com.mrbimc.selinux/

---------- Post added at 12:50 PM ---------- Previous post was at 12:38 PM ----------

I tried this but no luck. Although for some reason I was not able to change app name and try. So the best i could was package name changed, selinux enforced w/ magisk hide.
[Magisk] balotz:
This doesn't work for me. Changed the package name of Magisk, the app name itself, hid Santander from magisk hide, Selinux enforcing. It still detects root!
[Magisk] Pietolsen:
Did you clear the Santander app data?
[Magisk] MystaMagoo:
Just for info purpose.....

I use Santander Business Banking app,never had a problem.

Used to use supersu and now have magisk.
[Magisk] dead0:
The business app hasn't been updated since last year. I have an older copy v3.15 of the mobile app which still works under permissive but the latest versions with the new UI do not work with root
[Magisk] moe7863:
Almost there!

Check this out people! Might be of help:

https://xdaforums.com/showpost.php?p=77240186&postcount=68

---------- Post added at 10:49 AM ---------- Previous post was at 10:43 AM ----------

Hi

Thanks for all of the hard work you've put into getting around this issue and for the informative post. I have attempted this bypass and have been able to successfully login however, once the app is closed and reopens I receive the message stating that the device is rooted. I am following steps 11 and 12 to rename os.rooted.1 to os.rooted and os.rooted.hiders.1 to os.rooted.hiders but no luck :(

I look forward to hearing from you.
[Magisk] alpsayin:
Yeah man it's my bad, it's not permanent. As soon as Santander gains connectivity it sends out some sort of list and marks some file/dB to disable itself next time it's launched from scratch. I know this because even if you try disconnecting internet when you try to launch the app 2nd time, it immediately goes into app is rooted screen. Also, my device certification status is "Certified".
[Magisk] metrize:
Still can't pass itz even when magisk manager app is uninstalled. Maybe they are detecting magisk folder?
[Magisk] alpsayin:
I finally I have something.

Went back to my original proposed idea and tried to monitor network connections. Finally, I give you a permanent solution. Using Netguard app I noticed Santander contacts trusteer.com an IBM initiative for security. I was able to block trusteer from Netguard and bypass security checks for good.

However Netguard is a bit too much, it's a full networks monitoring app and a VPN service. So I tried putting the hosts in AdAway blacklist and voila. No fuss blocking. Survives a reboot.

You need systemless hosts + magisk hide and AdAway. You can find the list of blocked addresses in the screenshot. AdAway is running a webserver and I have no xposed.

THIS METHOD HIGHLY UNDERMINES YOUR BANK APPS SECURITY, AND IM NOT RESPONSIBLE IF YOU LOSE YOUR MONEY. BECAUSE AT THE END OF THE DAY YOU'RE CUTTING OFF ALL SECURITY CHECKS FROM YOUR BANK APP.
[Magisk] Didgeridoohan:
That's an interesting find. You should also be able to use AdAway's DNS requests monitor to find what domains the app connects to, and then directly add it to the blacklist from there.
[Magisk] sanguinesaintly:
I tried detecting and blocking the offending domains, both with adaway and then with adguard. In both cases, after a reboot, root was detected and no joy.

This is a tough one.
[Magisk] freezoid:
I've tried that with no success :S

EDIT: nvm I forgot to reboot after editing hosts

it worked for me
[Magisk] sanguinesaintly:
Still no luck even with reboots.
[Magisk] freezoid:
what worked for me:

- added modules: magiskhide props config and unified hosts adblock

- reboot

- installed adaway

- hide magisk manager

- install santander

- force stop + clean santander data

- magisk hide -> santander

- updated hosts + blacklist with adaway

- reboot
[Magisk] moe7863:
Success!

Massive credit to alpsayin for this method! I have successfully implemented this permanent fix and now using the Santander app after weeks of searching. The only thing that I would like to add to this is that AdAway now supports setting up systemless hosts so the only things that I needed were: MagiskHide props config, Adaway and Magisk hide.

Thanks again

Mo :)
[Magisk] Zentachi:
Worked for me too. Things that I needed were: MagiskHide props config, Adaway and Magisk hide.

If a similar exercise could be done for the Halifax app to determine whether it communicates with some domains that could be blocked, would be great!

Thanks again
[Magisk] alpsayin:
Have you cleared the app data and re-registered after doing all this? Once the app marks itself unsafe, there's no going back from that one.

On another note, this is pretty bad security practice from Santander isn't it?...

I'm sure they'll patch this up soon, so while you're at it block their analytics from AdAway too. Host is: e.crashlytics.com . Should slow the apps from sending back reports on what we're up to :)

---------- Post added at 06:12 PM ---------- Previous post was at 06:04 PM ----------

Don't have an account w/ Halifax but i was easily able to get to the register/sign in screen with the existing setup if that helps? Try the suggestion below, and if you're in doubt send the DNS log here.
[Magisk] dunjamon:
I can confirm that the same setup will work with the Halifax app. :good:
[Magisk] Zentachi:
Cleared data again, reboot, register and Halifax app is working also :)
[Magisk] sanguinesaintly:
Success at last. Used AdGuard to block the 4 offending domains Don't need to hide Magisk, or use the Magisk prop module. just hide Santander app from Magisk. Then clear Santander data and cache, reboot and activate and authorise. Survives reboots fine. Thanks to all.
[Magisk] nickster_uk:
Hi...

Is your resolution still working for you?

I've recently rooted my S7 Edge SM-935F with Magisk running stock. After rooting, I was able to get the Santander app working after hiding Magisk and hiding Santander in Magisk and it worked ok for a couple of days, but earlier today, it detected root again.

Thought it may be due to installing Xposed and Busybox so I hid both of them, plus all other apps that have root access in Magisk, but it's still not working. Also tried clearing Santander cache and data as well as rebooting, but no joy. Also blocked the domains using Adguard but not 100% correct the user filter rule is correct...

Does the following look right to you?

||*trusteer.com*^

Thanks for any help :)

---------- Post added at 01:17 AM ---------- Previous post was at 12:36 AM ----------

Got it working after uninstalling Xposed and related modules.

Looks like I need to try other methods to hide Xposed and any related apps.
[Magisk] MrPhilo:
When I use Magisk Hide on my Satander app it force closes. Anyone else?
[Magisk] metrize:
Nice find! It works! Blocking trusteer.com on it's own didn't work so it must be one of the other ones in that screenshot. Will leave them all though for now. Cheers
[Magisk] nickster_uk:
I had this a few times.

Do you have Xposed installed?

Have you cleared cache and data in Santander?

Have you hidden Magisk as well as Santander?

---------- Post added at 01:53 AM ---------- Previous post was at 01:25 AM ----------

What rules did you add to get it working please?

I've tried a few variations on the ones from the screenshot, but none have work as yet.

---------- Post added at 02:02 AM ---------- Previous post was at 01:53 AM ----------

It's definitely Xposed that is tripping things my end. When it's uninstalled, the app works perfectly after registering. When Xposed is present, root is detected. Adding the domains or hiding Santander and Xposed makes no difference.
[Magisk] MrPhilo:
No Xposed

Yeah I have tried that and reinstalling it

You mean Magisk Hide Santander? or is there another hidden thing I need to do
[Magisk] sanguinesaintly:
These are the domains I'm blocking with AdGuard
[Magisk] dunjamon:
The only thing I can't seem to do is make a payment. Although I don't know if that's an issue with the app on their side.
[Magisk] sanguinesaintly:
Payment works ok for me.
[Magisk] dunjamon:
Which addresses did you block? I did the ones from this post.

https://xdaforums.com/showpost.php?p=77321403&postcount=93
[Magisk] sanguinesaintly:
After 2 days, it detected root again. Found another domain to block

santanderuk.sc.omtrdc.net

Survives reboot ok,but let's see what happens over the next few days.

---------- Post added at 11:55 AM ---------- Previous post was at 11:31 AM ----------

https://xdaforums.com/showpost.php?p=77350020&postcount=110
[Magisk] dunjamon:
I'll update the list and see what happens. Cheers!
[Magisk] alpsayin:
Here's my final list including analytics reports as well. Payments/transfers/otp work fine. If it detects root it's probably because Santander managed to make a DNS query before your hosts file was updated. That's why you need systemless hosts. To guarantee my position I also now Greenify Santander to prevent it from waking up and doing stuff without my knowledge hehe
[Magisk] nickster_uk:
Made a bit of progress.

Uninstalled Xposed modules and framework, rebooted and Santander was good again.

Installed Xposed, rebooted, still ok.

Installed some modules and activated in Xposed and rebooted after each. All good until I got to Gravity Box. I got the Santander keeps closing error so I wasn't even able to get to the log in screen. I then tried checking the 'Disabled resource hooks' setting in Xposed. Rebooted and Santander was working again, logged in fine too. Downside is that any Xposed modules which try to change resources will no longer work with the setting activated. Shame as Gravity Box is rather good.

Also, added all the domains in Adguard for filtering.
[Magisk] metrize:
All of them in the screenshot I had added
[Magisk] sanguinesaintly:
The app updated itself a couple of days ago - still worked. Then this morning it says I'm rooted again. Cleared data and cache from app, re-entered credentials and, although it FC'd first time around. it's working OK.
[Magisk] Legoman6:
I have Magisk v16 and Xposed Framework (Systemless) v89.3 installed.

I've added the Root Cloak module to Xposed Framework.

Systemless hosts support for Adblock apps is enabled in Magisk Manager.

Added the Santander app to Magisk Hide and Root Cloak.

Added the entries advised by alpsayin to the AdAway blacklist.

Cleared the Santander app data and cache.

Santander app works fine and survives a reboot.
[Magisk] anttaz:
Works for me too thanks. Even after today's app update, still working as of yet ???

Update ... It stops Snapchat message sending ☹️
[Magisk] nickster_uk:
Santander seems to be working ok for me too, but only when I have 'Disabled resource hooks' checked in Xposed settings. When unchecked, Santander doesn't load, it just crashes on launch with a message saying 'Santander keeps closing', or something similar.

Are you using the same setting in Xposed?
[Magisk] Legoman6:
[MENTION=7393259]nickster_uk[/MENTION] I don't have the 'Disabled resource hooks' setting checked in Xposed.
[Magisk] sam00561:
can someone help ive tried many things i am not using xposed i am just rooted with magisk 16.7 hiding root for santander app. It used to work fine but now tells me phhone is rooted havent been able to use for 2 weeks.
[Magisk] sanguinesaintly:
I get that message every few days. Al I do is clear the app's cache and data, then reauthorize - then it works again.
[Magisk] sam00561:
ive tried that many times but still no go.
[Magisk] alpsayin:
Why do I have a feeling you didn't read the rest of the tread and you're only trying to use magisk hide? Look at post number 93 please.

https://xdaforums.com/showpost.php?p=77321403&postcount=93
[Magisk] sam00561:
I just added all those lines to my addaway cleared apps data tried to run the app and still detects root. Oh it is hidden in magisk too
[Magisk] alpsayin:
Are you using systemless hosts? Is webserver enabled in adaway? Do you have props.config module flashed and enabled in magisk? Did you try to force reload hosts definitions in adaway and then clear data for Santander and tried opening the app? Do you have other magisk modules that could be interfering like other adblockers otlr dnscrypt-proxy? Are you allowing good enough time for a reboot for magisk to settle and hosts file to be updated before running Santander? Does post number 68 work for you?
[Magisk] sam00561:
Ok thanks started working after starting webserver in addaway. Thanks again.
[Magisk] nickster_uk:
Thanks.

I re-enabled the setting after installing Root Cloak and adding Santander in it. Everything is working great and I'm able to use Gravity again :)
[Magisk] nickster_uk:
Balls. I had to format my data partition in order to be able to mount and back it up in recovery. Restored my apps and Santander knows my device is rooted again. Magisk is hidden, Santander is hidden in Magisk and also Root Cloak. Domains are being blocked by Adguard. Tried clearing the cache and restarting but no joy.

Just tried uninstalling the app, reinstalling. Hiding, rebooting...

---------- Post added at 10:18 PM ---------- Previous post was at 10:12 PM ----------

No joy :(
[Magisk] alpsayin:
You need a hosts file based system-wide adblocker, like adaway. From what I understand adguard is browser based and therefore won't work. Working blockers are netguard and adaway.
[Magisk] nickster_uk:
Thanks. It used to work ok with just Adguard. It filters apps as well as browsers.

Anyway, just tried with Adaway (which does look like a great little app) but same result. Also checked systemless support in Magisk.

Someone in the thread advised the Props.config module. I've downloaded, flashed and enabled it...but am I supposed to make any changes with it?
[Magisk] sanguinesaintly:
Adguard works fine for me. I do have to clear the Santander app's data every so often but I can live with that. I'm not using Xposed, nor am I hiding Magisk Manager, just hiding Magisk from the Santander app.