yashsingh1/xdaforums huggingface dataset:
[Android Apps and Games] simplydat:
Thanks for the explanation. I guess there is no way to prevent an app from knowing if I have a particular file/folder on my device, is there? i.e Fooling the app into thinking everything is "no such file or directory" instead of "permission denied." Or outright block the app from executing ls on my device.

I did mention crash, but I know for certain the crash is result of root as the app developer mentioned that's how the app will behave when root is detected. It will not show any messages.

Another reason I know for sure is when I install the same app in a clean "work profile" on the same phone, the app will launch fine.

I didn't list all the info because I wasn't sure if they were relevant as I have managed to hide root from every single bank app / mobile app on my phone except one. So I do have a little bit of experience with root hiding.

The the info are: Magisk 23.0. Safety already passes and Google Pay works so I don't think I need USNF. I am also using an official rom for my Asus Zenfone 7.

I also tried hide my applist and xprivacylua to block everything this app can read.

The name of the mobile payment app that detected root is called "LINE Pay". The latest version v.3.8.0 is the one with much more serious root detection. I can of course downgrade to v3.6.0 that works, but my inner urge to find out exactly how the app is detecting root is haunting me, a bit OCD really. So I really wanted to find out how this one app manages to detect root while every other app can't.

I am now in process of using APKtool to decompile the app, but I have no clue what I'm doing or looking for once the apk has been decompiled as I've never used APKtool before. If you also have any experience in that field, feel free to share. Thanks!

Update: I've managed to decompile the app, now... just need to know what to look for.
[Android Apps and Games] crok.bic:
ie. Momohider, storage isolation is the word you are looking for. But this is not what you need I think.

From this point this is offtopic AF.. but some hints:

Since you've mentioned that in a work profile it is working.. I think this is not a dir/file detection but detection of the hidden Magisk app itself.

You can try the following: install AirFrozen or Ice Box for example, run it, give it root permission when it is asking for root, then disable the hidden Magisk app ("freeze" like you issue adb pm disable on the Magisk app) and try to run the banking app again. Don't worry about the Magisk app, if you go back to AirFrozen or Ice Box and unfreeze it it will just work as before. While it's frozen it does not affect the root permissions and Magisk (and all the modules) running since Magisk is using the settings stored in /data/adb and in it's own databases / files.

But I stop the offtopic tsunami here. You can seek for advise in the Magisk topics around XDA.
[Android Apps and Games] simplydat:
Hi @VD171

1. May I know what these two files are? These also came up on my device after the scan. I cannot get rid of them.

/system/lib/libsigchain.so

/system/lib64/libsigchain.so

2. How to properly use xprivacylua?

You mentioned it's the best. However xprivacylua needs to hook LSposed into the app you wish to hide e.g bank app in order to work. But most app checks for the presence of exposed at runtime.

So the problem is if I hook LSposed to the app, I can hide whatever xprivacy designs to hide, e.g applist. But LSposed gets detected.

If I don't hook LSposed to the app, Xprivacy doesn't work at all.

Also Xprivacy creates a folder called xlua in /data/system which also gets detected by VD Infos.
[Android Apps and Games] VD171:
NO. And never will can.

Android is LINUX, and linux is based on users, groups and levels.

So, only authorized users can read, edit or execute their own files.

Storage permission is not totally required if you can read, edit or execute files using shell or native library.

Yes, XprivacyLua can blocks ANY type of usage on Android.
[Android Apps and Games] VD171:
The file libsigchain.so works on art modifications, so this file can appears with luckypatchers, xposed, custom recoveries or some other type of customization.

XprivacyLua does NOT work alone. You need to choose what to block.

Certainly, you need custom hooks made by other users.

I suggest you to try all hooks made by @Fif_ ♥️ 👏

You can find them on XprivacyLua repository:

https://lua.xprivacy.eu/repo/

Apparentely, XprivacyLua needs an auto self-hiding, because it can be detected easily too.
[Android Apps and Games] crypticc:
Hello hoping someone can help me. I've got a stubborn app that keeps kicking me out because of root detected.

I'm running latest Canary magisk for example safetynet fix, magiskhide, etc. both result in both CTS and Safetynet passing. and Gpay works okay but another app does not.

But what does the test below mean? I did do magiskhide and safetynet fix using the latest magisk Canary build.

Thank you.

Chris
[Android Apps and Games] crypticc:
P.s. Pixel6 pro, unlocked + stock + magisk + zygisk + safetynet patch.zip
[Android Apps and Games] VD171:
Means you have a rooted device.
[Android Apps and Games] crypticc:
Yeah thanks. 😃

But shouldn't magisk hide have, well, hidden it?

Btw... When this APK tried to grab SU and request phone and storage permissions etc I denied so was a little surprised it managed to Cat the folders and mount points at all.

Rootbeer doesn't find rooted but this APK does
[Android Apps and Games] VD171:
Exactly.

Magiskhide hides that.

Check your settings.
[Android Apps and Games] crypticc:
Okay thanks again. When I installed this app I had forgotten to tick the app in Magisk deny list. Fixing that and now all that's left now is "emulator detected".

This is running system properties, classes, processes, and files basic. Files aggressive didn't complete but I think the phone decided to just terminate the app so not a big deal.

So what is that "emulator" and do you think that's what would be triggering the root detection on the other app?

Now sorted the basics please feel free to redirect me or even just tell me to go away if you don't want the question in your app thread as I do realise the question is now no longer about the app.

By the way... Before you do. Very insightful app

Chris
[Android Apps and Games] VD171:
About Magisk v24+ and Zygisk:

Actually, you can hide root and xposed, using the xposed module XPrivacyLua together the magisk module: SHAMIKO !

And, you can fix safety net, using the magisk module: UNIVERSAL SAFETYNET FIX !

I've installed Magisk v24.3, LSPosed v1.8.1, Shamiko v0.4.4, XPrivacyLua v1.30, Universal SafetyNet Fix v2.2.1 and everything is working perfectly.

(Keep Attention ! You need to

ENABLE

Zygisk,

ENABLE

DenyList and

DISABLE

Enforcing DenyList.)

LSPosed developers

and community of contributors are doing an

INCREDIBLE

work with LSPosed and Shamiko, I have no words to say how I love them. ♥️

If you want to hide something else, you can try custom hooks written in Lua on XPrivacyLua.

If you want to hide something more, certainly you can write your own lua script for XPrivacyLua.

XPrivacyLua is really extensible, so you can build your own Xposed script without compiling anything.

If you never try XPrivacyLua, certainly you should it !

If you are a regular user of XPrivacyLua, you should try new lua scripts too, you can see some custom lua scripts uploaded by community on XPrivacyLua repository: https://lua.xprivacy.eu/repo/

Good luck 🥰

Magisk: https://github.com/topjohnwu/Magisk/releases

Author: @topjohnwu

LSPosed: https://github.com/LSPosed/LSPosed/releases

Author: LSPosed Developers (@Dr-TSNG, canyie, kotori2, vvb2060, yujincheng08)

Shamiko: https://github.com/LSPosed/LSPosed.github.io/releases

Author: LSPosed Developers (@Dr-TSNG, canyie, kotori2, vvb2060, yujincheng08)

XPrivacyLua: https://xdaforums.com/t/app-xposed-6-0-xprivacylua-android-privacy-manager.3730663/

Author: @M66B

Universal SafetyNet Fix: https://github.com/kdrag0n/safetynet-fix/releases

Author: @kdrag0n

PS: Do NOT expect SHAMIKO to be open source ! It will keep the source closed, because as @topjohnwu already said it's a cat-and-mouse game.
[Android Apps and Games] locolyric:
any tutorial to hide custom hooks ?

my banking app still able to detect root after i use all of the apps above.
[Android Apps and Games] VD171:
Hooks are made to hide something.
[Android Apps and Games] doggydog2:
I'd like the app to try location. With XPrivacyLua now unusable for a long time (with LSPosed), I am using permission managers and there are now many combinations of Coarse and Fine location in Android12. Here's what i apply:

- Coarse=Allow, Fine=Allow for apps that really need location like Uber

- Coarse=Allow, Fine=Ignore for apps that only need to connect to devices like any bluetooth app operating hardware

- Coarse=Allow, Fine=deny (somewhat corresponding to unchecked [ ] Precise location in settings) for apps that i want "almost" fine location like Weather

- Coarse=Ignore, Fine=ignore for most other apps

But VDInfo® will always report my city. I'd hope to see what location any app can really get.
[Android Apps and Games] VD171:
The city name is shown as a name or as a geo position?

Probably it is now shown by the location.
[Android Apps and Games] doggydog2:
yeah there's a city. But that information is vague, since Maps will tell me that "You were in the city" even when i turn off location completely, making me think city can be figured out at any time.
[Android Apps and Games] VD171:
The SIM contains geo locations too.
[Android Apps and Games] xSnowLeopardx:
Thank you for this. I can successfully screenshot in apps and open apps that previously were denying access due to root. Shamiko is a life saver (SafetyNet Fix as well).
[Android Apps and Games] VD171:
You are welcome, my friend.

I'm totally agree with you :)
[Android Apps and Games] JazonX:
I'm slightly confused, How do you enable screenshots in all apps ?

What's the new method for this? I used to have SmaliPatcher - but that doesnt help in A12.

Secondly;

Also, there is an app I want to spoof the location. Actually I want the app to only see one particular location I have set - eg: I want the app to see the location of my car's dealer - so the app always behaves as if I'm physically at the dealership. I got XprivacyLua both (including the pro - paid app).

Any help on above is much appreciated !
[Android Apps and Games] VD171:
Just disable flag secure.

https://github.com/LSPosed/DisableFlagSecure/releases

or

https://repo.xposed.info/module/fi.veetipaananen.android.disableflagsecure2

Just enable "get protection" in XprivacyLua and paste the position in Pro app.
[Android Apps and Games] JazonX:
Thanks, Does this work if the same app is in the DenyList hidden from Magisk ?

This particular app detects root as well.
[Android Apps and Games] VD171:
If you enable enforcing denylist, XPrivacyLua will NEVER works.

You should NEVER enable enforcing denylist.

Keep enforcing denylist DISABLED forever.

Just install the magisk module: SHAMIKO.

This module will hide root from processes in the deny list.

Shamiko Official Website:

Releases · LSPosed/LSPosed.github.io

Contribute to LSPosed/LSPosed.github.io development by creating an account on GitHub.

github.com
[Android Apps and Games] JazonX:
Ok, I think my understanding had a gap, First of all - Thank you so much for taking time to answer and clarify!

* I thought Shamiko works only on the apps which are on the deny list (with DenyList function unticked in Magisk settings, But apps selected in the list) .

* The App I need to spoof location detects root - So I have kept it in Deny List - but the function from Magisk disabled - because I thought Shamiko enables whatever the blackmagik it has only if that app is in the deny list.

In the above situation - Can I cloak root also from lsposed ?

Below is the app I want to Spoof location in Lsposed.

So sorry for taking your time with these stupid questions.
[Android Apps and Games] VD171:
If you select LSPosed in denylist, LSPosed will certainly not work perfectly.

Xposed does NOT require rooting, but LSPosed requires Magisk.

If you enable enforcing denylist, Shamiko will not work.

If you want Shamiko to work, you should disable enforcing denylist.

Shamiko is applied to apps only in denylist.

If you want to hide root, just install Shamiko, disable enforcing denylist and select all processes for the app in denylist.

If you want to spoof location, XPrivacyLua is a good option.

XPrivacyLua hides the location in many ways for reading location.

But, the SIM also contains geo locations that can expose your location.
[Android Apps and Games] JazonX:
Thanks a lot! Crystal Clear explanation !
[Android Apps and Games] VD171:
You are welcome, my friend :-)
[Android Apps and Games] JazonX:
Hey Mate, Need to pick your brain again for a bit;

You were right about the SIM Location Part.

My app - Despite me faking the location, kept getting my accurate location.

I read your post again, and thought it might be taking the location from the SIM..

Then in XPrivacy - I ticked Read Network Data - and then the app started showing the location failed message. So means it's taking the location from Network data / not exactly the GPS, or maybe a combination of both because if I turn off location from quick tiles - then it fails as well.

Is there a way to spoof this network data ?
[Android Apps and Games] VD171:
Probably, yes.

But as that spoofing is not default in XPrivacyLua you may need to it by yourself.

For an example, editing the default spoof for "TelephonyManager/getNetworkCountryIso":
[Android Apps and Games] AndroidX:
what is targetsdk of your app @VD171
[Android Apps and Games] VD171:
Android 12 (SDK 31).
[Android Apps and Games] Micky352:
Hello @VD171,

Sorry to say but one of your mate fif_7 doesn't seems much helpful. I really need some help or kinda abstract view bout the problems i am facing...

Is it possible to hide xposed hooks from an app.

And please it's my humble request please update BlockGuardOs.Open or give your own LUA script which can block Such arbitrary folder / file detection by apps. Waiting for your response...
[Android Apps and Games] Micky352:
Bruh did you got the solution for this... I am also trying to find the solution for the same problem... Lua.db get caught every time despite of i am using some custom XPL Scripts given by @Fif_ ( thanks a lot for your efforts bruh ) ie BlockGuardOs.Open and ProcessBuilder.start and Runtume.exec as well nothing changed. It still catching the snake's hood...
[Android Apps and Games] VD171:
No, that's not possible.

For hiding xposed you need native methods only.

Java methods can be traced.
[Android Apps and Games] Micky352:
Thanks a lot @VD171

When i select my banking app to any of my LSPosed module... It closes without any error... Just selecting that banking app in XPL makes it crashes...

Is there any suggestions what i can do...

Or the only way is to modification of the app...
[Android Apps and Games] simplydat:
The solution is simple, don't use Xprivacylua.

It's not needed to hide root with Magisk 24. Go check it out, there are lots of tutorials on how to hide root detection on Magisk 24.

Basically Zygisk mode + Shamiko.
[Android Apps and Games] VD171:
Apparentely, the app is detecting some modification inside itself.

You need to find and disable/remove this detection modifying the app.
[Android Apps and Games] Micky352:
There are some detection apps like OpRek , VDinfo and Applist Detector did you tried them ever... If not please give them a try and let me know tge results for zygisk + shamiko
[Android Apps and Games] dope77:
This app is so damn great, helped me a lot while setting up XprivacyLua hooks. I'm just facing one problem. How does the app show both real and fake data at same time? Does it use more than one method for each piece of info? (like more than one method to obtain device id, fingerprint...)
[Android Apps and Games] VD171:
My app VD Infos, tries many and many ways for reading some info.

XPrivacyLua is one of the best app ever.

Only basic and simple hooks are present in default settings.

If you want specific spoofs, you have to use custom hooks.
[Android Apps and Games] oldman20:
Can OP help me!? I do all i can but still cant make netflix and some apps show up in Play Store!
[Android Apps and Games] VD171:
I see no correlations of detections with Google Play Store.

Some apps are now requiring Play Protect enabled, just it.

About Netflix, you can download latest release directly from the official website:

Netflix says, 'Your device isn't compatible with this version.'

This message means your Android phone or tablet might not meet the Google Play Store requirements for downloading the Netflix app. Follow these steps to check your device's certification status.

help.netflix.com

Can't find the Netflix app

Most TVs and streaming devices come with the Netflix app included. If Netflix isn't in the app store on your phone, tablet, or computer, you may need to update your device.

help.netflix.com

You can too download and install other apps manually:

F-Droid - Free and Open Source Android App Repository

F-Droid is an installable catalogue of FOSS (Free and Open Source Software) applications for the Android platform. The client makes it easy to browse, install, and keep track of updates on your device.

f-droid.org

Aptoide - The alternative Android app store

Find, discover and download the best apps and games for Android in the official Aptoide app store

aptoide.com

Download APK free online downloader | APKPure.com

Download apk for Android with APKPure APK downloader. NoAds, Faster apk downloads and apk file update speed. Best of all, it's free

apkpure.com

APKMirror - Free APK Downloads - Free and safe Android APK downloads

Free and safe Android APK downloads

apkmirror.com

⚡ APKCombo - #1 APK Downloader

Download APK for Android Game, Android App - Latest Version, Old Versions, Android Tablet, Android Smart TV, Android Wear, armeabi-v7a, arm64-v8a, x86, x86_x64 - Free

apkcombo.com
[Android Apps and Games] ihavenolifee:
Total found: 4.

* Emulator detected.

================

-> ROOT

#1. [* EMULATOR]: android-build

#2. [* EMULATOR]: [ro.build.user]: android-build

#3. [* EMULATOR]: [ro.bootmode]: unknown

#4. [* EMULATOR]: [ro.product.system.device]: generic

What would these things cause?

Curious if the Chase Banking App detects these as I can't get it to fully work with everything I try.
[Android Apps and Games] VD171:
This means you are using an android emulator or a custom/modded rom.
[Android Apps and Games] ihavenolifee:
Yea I figured although I believe I'm on the stock OS for the Pixel 6.

Strange. I'll run a full check. Maybe that's why the Chase app doesn't work for me hah
[Android Apps and Games] ihavenolifee:
Total of tries: 7,261,495.

Total found: 7.

* Emulator detected.

================

-> ROOT

#1. [* EMULATOR]: android-build

#2. [* EMULATOR]: [ro.build.user]: android-build

#3. [* EMULATOR]: [ro.bootmode]: unknown

#4. [* EMULATOR]: [ro.product.system.device]: generic

#5. [Found]: eu.faircode.xlua

#6. [Found]: eu.faircode.xlua.ApplicationEx

#7. [Found]: /data/system/xlua

================

This is the full one actually.

For the Emulator I thought I was on Stock ROM so a bit confused.

Also any idea what to do with the XluaPrivacy files found?

Thanks again.

Still think the Chase app is like just superior somehow haha
[Android Apps and Games] sasha007:
@VD171

Does my log signify root? I'm using Magisk v23 and magiskhide vdinfo. Also using XprivacyLUA with everything restricted for vdinfo.

How do i fix these findings?

-> Quantities

Total Time: 50 minutes and 12 seconds.

Total of tries: 6,311,301.

Total found: 40.

* Emulator detected.

================

================

-> ROOT

#1. [* EMULATOR]: unknown (SIM1)

#2. [* EMULATOR]: unknown (unknown)

#3. [* EMULATOR]: [gsm.network.type]: Unknown,Unknown

#4. [* EMULATOR]: com.device.emulator

#5. [Found]: com.keramidas.TitaniumBackup

#6. [Found]: com.keramidas.TitaniumBackupAddon

#7. [Found]: eu.faircode.xlua

#8. [Found]: eu.faircode.xlua.pro

#9. [Found]: /data/system/xlua

#10. [Found]: /data/system/xprivacy

#11. [Found]: /system/lib/libsigchain.so

#12. [Found]: /system/lib64/libsigchain.so

#13. [Found]: /system/lib64/libart-disassembler.so

#14. [Found]: /system/lib/libart-compiler.so

#15. [Found]: /system/lib64/libart-compiler.so

#16. [* EMULATOR]: /data/data/com.device.emulator

#17. [* EMULATOR]: /data/user/0/com.device.emulator

#18. [* EMULATOR]: /data/user_de/0/com.device.emulator

#19. [* EMULATOR]: /data/misc/profiles/cur/0/com.device.emulator

#20. [* EMULATOR]: /data/misc/profiles/ref/com.device.emulator

#21. [Found]: /data/data/com.keramidas.TitaniumBackup

#22. [Found]: /data/user/0/com.keramidas.TitaniumBackup

#23. [Found]: /data/user_de/0/com.keramidas.TitaniumBackup

#24. [Found]: /data/misc/profiles/cur/0/com.keramidas.TitaniumBackup

#25. [Found]: /data/misc/profiles/ref/com.keramidas.TitaniumBackup

#26. [Found]: /data/data/com.keramidas.TitaniumBackupAddon

#27. [Found]: /data/user/0/com.keramidas.TitaniumBackupAddon

#28. [Found]: /data/user_de/0/com.keramidas.TitaniumBackupAddon

#29. [Found]: /data/misc/profiles/cur/0/com.keramidas.TitaniumBackupAddon

#30. [Found]: /data/misc/profiles/ref/com.keramidas.TitaniumBackupAddon

#31. [Found]: /data/data/eu.faircode.xlua

#32. [Found]: /data/user/0/eu.faircode.xlua

#33. [Found]: /data/user_de/0/eu.faircode.xlua

#34. [Found]: /data/misc/profiles/cur/0/eu.faircode.xlua

#35. [Found]: /data/misc/profiles/ref/eu.faircode.xlua

#36. [Found]: /data/data/eu.faircode.xlua.pro

#37. [Found]: /data/user/0/eu.faircode.xlua.pro

#38. [Found]: /data/user_de/0/eu.faircode.xlua.pro

#39. [Found]: /data/misc/profiles/cur/0/eu.faircode.xlua.pro

#40. [Found]: /data/misc/profiles/ref/eu.faircode.xlua.pro

PS- Oprek detector doesn't detect anything but applist detector detects xposed hooks (attached screenshot)
[Android Apps and Games] VD171:
Yes, because you are using apps for rooted devices only.

You can hide all them using custom hooks on XPrivacyLua.
[Android Apps and Games] sasha007:
Thanks for your review. Can you kindly advise which hook to specifically use to hide these apps?

Also, will hiding these fix applist detector identifying Xposed hooks and XPrivacyLua?

One additional thing is Momo root detector says the environment is broken. Is this something to be concerned of?
[Android Apps and Games] VD171:
Almost all methods present in PackageManger can gather details about installed apps, see here: https://developer.android.com/reference/android/content/pm/PackageManager#public-methods

Applist Detector uses queryIntentActivities().

XPrivacyLua is being detected because its folder path is permanently same, we should just hope @M66B fix that generating a new one folder path for every new installation and then avoiding any type of folder/file detection.

Since detections of momo are present in native codes only and its source is closed, you can just ignore its results.
[Android Apps and Games] sasha007:
Ok, since my VDINFO results didn't actually detect root, am I ok not mitigating the other files found by it if the apps I intend to run don't detect root either. Is the Emulator detected by VDInfo a sign that apps can detect root? I am a delivery person so my use case is with Uber, Lyft, Instacart type of apps.
[Android Apps and Games] VD171:
Yes, if my app VD Infos can read something, any other app can read the same thing.

Shamiko is enough for basic hiding root.

If you didn't have problems, so theres is nothing for fixing :cool: