[Android Software Development] pndwal:
👍... Some fix, some just read, play, communicate... 😉

Great Question!

Re. DenyList, Root hiding, Shamiko and more... For all who consider themselves part of the Magisk Community...

Yuko Yoshida (Shamiko) is quite the contradiction; she's the friendly compassionate demon highschool girl who's constantly sick and physically weak but possessed of an incredibly strong will and unshakable resolve despite having developed a fear of being a burden to others...

View attachment 5832471

Let's not delve any deeper into Shamiko's psyche, but "Don't think this means you've won!"...

DenyList can do basic hiding, but it works by denying Magisk / modules access to processes listed and so can work against you...

For example, denylist could work to hide root from gms's attestation/droidguard service which is necessary for USNF to work, but since USNF must also inject code into the same processes (to register the fake keystore that trips the fallback to basic attestation as well as to perform prop spoofing targeting the same process(es)), using denylist prevents those modifications from being applied and effectively breaks USNF!... That's why USNF now does the root hiding itself and removes the gms attestation/droidguard process from denylist on reboot so if user adds that, at least it won't persist... Nb. Previous USNF versions used old hidelist as there are no such issues; proper hiding doesn't deny Magisk modifications or revert them like denylist does.

The purpose of denylist is NOT hiding root (although it necessary hides basic aspects of root by reverting/denying Magisk modifications in listed processes)...

It actually seems to be aimed at Devs who use Magisk as a development tool, eg for production devices incl. security research. As such it's use for modders in general is quite limited... John said:

I put a lot more about denylist uses here:

https://xdaforums.com/t/discussion-magisk-the-age-of-zygisk.4393877/post-87010491

Further:

https://topjohnwu.medium.com/state-of-magisk-2021-fe29fdaee458

This blog makes clear that DenyList was a complete repurposing of the "minor subset of the MagiskHide infrastructure" that remains, and that for John (@topjohnwu)

... What you need for proper root hiding is a proper HideList solution like @canyie's Shamiko. (Nb. It uses Magisk DenyList's list only... It is implemented as hidelist; it does NOT use Denylist framework/API.)

Many users previously installed Riru modules for running module code in apps by injecting into zygote, an easily detectable root trace. MagiskHide didn't hide it, but Rikka's Riru framework module had inbuilt hiding (from v22):

https://github.com/RikkaApps/Riru#how-does-hide-works

We now hook processes / inject into Zygote using Zygisk, but this makes no attempt to hide itself (surprise surprise!), so the entrance of Zygisk from stage left w/ Magisk 24.0+ created an immediate need for proper root trace hiding... Enter Shamiko from stage right...

Shamiko was initially able to hide Magisk root and Zygisk hooking although not fully, and Zygisk hiding has since been improved along with the addition of hiding for isolated processes, modified init.rc and more root traces...

I put complete changelogs / use notes here:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-86889071

or extract readme.md from current Shamiko module...

Nb. The first Shamiko builds offered via GitHub offered whitelist mode, (hides root from most apps by default if enabled) and readme.md notes for whitelist says there is s "significant performance and memory consumption" hit, and that it should only be used for testing... Most users will just use Blacklist mode...

Re. Closed source:

There are less sophisticated open source alternatives to Shamiko, eg DenylistUnmount (I don't think this can hide Zygisk or achieve other sophisticated hiding) that are enough for bypassing many bank's detections...

But I wouldn't be too paranoid...

For example, parts of Magisk remained closed source for a long time, eg Hide the Magisk app obfuscation method and stub code; he only open sourced most of this recently (search his Twitter), but only gave samples of some of the code... It's actually hardly surprising that some Devs don't want to publish their hiding code... If you think about it... 😶

Shamiko's additional hiding methods including isolated process leaks (unshare), modified init.rc traces etc were previously refined by LSP Devs, notably vvb2060 and @canyie, and while it was a Canyie initiative it continues to be an LSPosed Dev joint effort... Note: The current main Magisk Devs are LSPosed Devs... LS = LoveSy (lovesykun) = @yujincheng08 = Shana Saimoe... (See Magisk App home screen... Or have a crack at breaking in to John's Slack group... 😜)

Anyway, Canyie's original Riru-MomoHider module was open source. She put her reasons for making its successor Shamiko closed in her MomoHider Readme page:

https://github.com/canyie/Riru-MomoHider#deprecation-notice

So modders need to use good judgement, but can vote with their feet ...

FWIW, Canyie is the youngest of the prolific LSP contributors it seems, but is associated with reputable modders who's code you also rely on in Magisk... Actually Canyie is a prolific Magisk contributor also...

👀 PW