yashsingh1/xdaforums huggingface dataset:
[Magisk] slimshouki:
I tried everything regarding this app (com.egyptianbanks.instapay) using zygisk, HMA and shamiko (disabling enforce list and adding app to the denylist) but always detect root and app crash at startup

The only method it works is to disable zygisk and enable conventional magiskhide only.

App link if anyone want to try: https://play.google.com/store/apps/details?id=com.egyptianbanks.instapay

Momo is giving me as attached but eventually concerned app is working fine when magiskhide is enabled so I dont know what really triggers root detection if zygisk and shamiko is enabled while its added in Denylist
[Magisk] mGforCe:
With reboot and without reboot, post enabling "Denylist" Shamiko displays below error

Shamiko doesn't work since enforce denylist is enabled :(

Issue is that some bank apps need Shamiko..
[Magisk] mGforCe:
Thanks... I didn't share, but even for me, on Nokia 6 with Stock Pie rooted, HSBC works without any jingbang

Sorry, but point 1 is still not clear. There is no mention which method for what... or is it hidden between fine details...

Point 2 - noted, thanks.
[Magisk] mGforCe:
I tried previous 2 versions... SC Bank app doen't work with neither builds of Shamiko.

Shamiko is closed source right, no way to raise bug/issue right?
[Magisk] J.Michael:
The post @pndwal offered mentioned a hiding technique which should be used only when needed. This technique did not appear to me to be one of the three named in the post in this thread which specifically said "do not select ALL TECHNIQUES".
[Magisk] J.Michael:
"Closed source" doesn't mean you can't raise bug/issue.

I think you will need to use Telegram to report an issue.
[Magisk] zgfg:
Without reboot is irrelevant - on any change (enable/disable Zygisk, Enforce DenyList; reconfiguring DenyList, installing/enabling/disabling a module - Shamiko or any other) you MUST reboot

Yes, Shamiko REQUIRES that DenyList is disabled. That's it - if DenyList is enabled, it warns you that you must disable

However, you still have to Configure DenyList, putting your banking app into, etc - because Shamiko will read from that same DenyList (it is disabled for the built-in Magisk part. but Shamiko then takes care of the list)

Shamiko is probably the closed source (answering to your another mail) but it has been mentioned here several times who develops Shamiko (same dev as LSPosed), hence you can go to her GitHub and find a way there to get in contact by mail (there is also a Chinese TG channel about, but that's another story about the language/foreigners, getting in, etc)

That's the best I can answer you

And sorry but cannot help you about the particular banking app:

I also use Magisk, Shamiko, LSPosed, etc - and I don't have problems with the apps I use (I still successfully hide root from all of them - except from Momo but who cares about her)

But if/when the day comes that some of my important apps will start detecting root and I would not be able to hide - I will (reluctantly) uninstall Magisk and TWRP and relock BL.

And I will continue playing then with root only on my old (still functional A11) phone that is not my daily driver😩
[Magisk] mGforCe:
I hear you, but in my experience for the below two cases reboot has no impact.

reconfiguration of Denylist,

enabling/disabling of Enforcing Denylist

I say so, because in case of SC Mobile, once I enable "Enforcing Denylist", there is direct impact seen on the app. Without need to reboot.

Same is case for reconfiguration of Denylist... one we add an app (notorious one which detects root prior adding here) and then launch it, without rebooting, the app can't detect root.

But yes, for all others, like enable/disable Zygisk, modules etc...one needs to reboot.
[Magisk] mGforCe:
yes, seems to be the case.

My original question to shadowstep was on how to decide which of the various hide methods to be selected. I might have been overdoing a bit by selecting all and hence wanted to learn
[Magisk] mGforCe:
Appreciate you taking out time... I have dropped an English and Chinese (google translated) note on their TG group. Let's see

No worries, your replies have give me some more info. And indeed there are so many variables, difficult to zero down on exact root cause and the solution... but atleast we tried..
[Magisk] mGforCe:
Problem solved... Thanks to post of @d0a0de5d32 here

While we were talking about Shamiko and enabling/disabling enforcing denylist, but solution came via tweaks to HMA and restricting the options selected to hide detection.

So learning what and how to select in HMA is very important. Look forward to hear from @shadowstep

Thanks @pndwal @zgfg @J.Michael for your guidance and inputs

EDIT: It seems, checking things late at night have its own perils.

Yes, while the app can open and is no longer crashing post these changes, post login to account, am greeted with message that device seems odd (root being detected) and doesn't allow logging into app.

At same time, just enabling "Denylist" allows bank app to login.

So back to square one :( Problem remains...
[Magisk] pndwal:
🤔 - Linked section says:

https://github.com/Dr-TSNG/Hide-My-Applist#how-did-hma-magisk-module-work

Seems to indicate clearly that file detection & maps scan methods use detectable syscall hook etc, so 'do not switch these on if not needed'.

You asked

... Since there are only the five 'hide methods', if file detections & maps scan are avoided due to potential for detection, this leaves only Check API requests, Intent queries & ID detections 'hide methods'...

I linked this as dev provides screwdriver set as well as wrench and hammer, but tells you herself to try screwdrivers before getting out wrench and hammer... 😜

This said exactly the same thing! 😁

Nb. The GitHub issue that member mentioned has a comment about v2.3.2 release notes:

https://github.com/Dr-TSNG/Hide-My-Applist/issues/148#issuecomment-1055194323

Re. File Detections the dev says there:

also this re. Maps Scan:

... Always pays to read Dev notes on first use of most mods / utilities! 😝 ... readme.md, release notes, change log(s), forum OPs... Saves issues, searching, questions, frustration... 😜 PW
[Magisk] shadowstep:
I just did my reading before setting everything up, as simple as that. :) I decided to select just those three before going all nuclear with all the hide methods. The post below covers everything I read prior to trying out what works the best:
[Magisk] mGforCe:
Now, that you said so, I was able to correlate...otherwise, prior, post scanning couldn't decipher. Trust me - I did read twice :(

Nice analogy 😜

Agree, but sometimes readme, notes are too cryptic for laymen like me.

Anyways, I rushed to say that problem is solved.. While app no longer crashes, can't login, it somehow detects root/something odd here with HMA & Shamiko..

If and when I enable Denylist, all is good.
[Magisk] mGforCe:
Thanks. Yes pndwal did share details. His earlier reference went over my head. But this later post, was quite helpful.

I will now change hide method in HMA, across all the apps and stop using the last 2 hide options (file detection / maps scan interceptions)

Curious, do you happen to use Axis app? The same can't work without xprivacylua, atleast as per me and many people on reddit etc.

Wondering if you use same and were able to run just using HMA.
[Magisk] mGforCe:
I was able to reach to their TG discussion group, share my issue and did get one or two response which was to delete "enhanced mode for HideMyApplist" module.. which I did. But there was no benefit of this.

Then I mentioned about success in opening app (no longer crashing) after not switching on file detection / maps scan interceptions

But here too the app, post login credentials, detects root.

And then some other TG admin, just muted me for a few days saying not linked to LSposed :cry: :oops:
[Magisk] zgfg:
Do not mix up Shamiko and HMA.

Did I mention HMA by any word in my previous response to you?!

You asked about Shamiko and how to reach its developer, I told you it's the same developer as for LSPosed and actually suggested you to reach the developer by e-mail you find from her GitHub

HMA is just a module for LSPosed, developped by totally different developer, and indeed it has nothing with their LSPosed TG channel, and their discussion there

Please do your own research (don't be a layman - your own words), google about HMA:

GitHub - Dr-TSNG/Hide-My-Applist: An Xposed module to intercept applist detections

An Xposed module to intercept applist detections. Contribute to Dr-TSNG/Hide-My-Applist development by creating an account on GitHub.

github.com

Hide My Applist

隐藏应用列表 Release / Beta 通道

t.me

And by the way, HMA and Shamiko/DenyList do totally different things. One cannot substitute the other

DenyList and Shamiko serve to hide Magisk itself

Hide My Applist serves to hide one app from another. Eg, Magisk APPLICATION from your banking app.

You must distinguish Magisk (service, mask, whatever you call it) and Magisk app (previously it had 'better' name manager that better describes what it is - just a MANAGER to manage the Magisk).

Eg, you could uninstall Magisk app and your Magisk (root, modules, etc) will all continue to work (even after reboots).

And you could still manage your Magisk but by using it's Command Line Interface (from Terminal), and by directly editing the Magisk database

Banking apps use different techniques to look if you have 'root'

On one side they look for the root itself, on the other some may also look for the Magisk app (reasoning: Why would somebody install Magisk app if he/she does not have Magisk).

But actually you can install Magisk app to the phone with the locked Bootloader, untouched stock firmware, hence no Magisk at all - and if your banking app, among other techniques, looks for the Magisk app, it would still 'complain"

Similarly, some look for the TWRP folder (reasoning: why would someone have TWRP folder if TWRP is not installed).

You simply delete TWRP folder (or just rename) and they no more find it and 'complain' (ofc, they don't tell you in plain they found Magisk, Magisk app, TWRP folder or what - they just refuse to work)

And eg, you can use HMA for other purposes (not related with banking apps and 'hiding' root).

Eg, you want to prevent PlayStore to know that you have certain app installed, and want to prevent it from automatically updating that app or bothering you that your version of that app is outdated.

Eg, I use it for hiding/detaching YouTube and Android Auto from Google Play, since I need to run the particular old versions of YT and AA (as I need them for Vanced YT root and some hacks for Android Auto that work only with those old versions of YT and AA)
[Magisk] mGforCe:
No, you didn't mention about HMA... and neither I attributed it to you.

But after further reading and trials, it was found that atleast for the SC Bank app - crashing is linked to both

1) Shamiko 2) HMA

My trial and error scenarios:

Scenario 1: If we disable Enforce Denylist, have Shamiko module enabled, and HMA configured with "Enable all hide methods" - the app crashes

Scenario 2: If we continue with disable Enforce Denylist, have Shamiko module enabled, and HMA configured with "only first 3 hide methods" - the app doesn't crash, but we can't login.

Scenario 3: If we enable Enforce Denylist, essentially meaning Shamiko is inactive, and HMA configured with "Enable all hide methods" - the app doesn't crash and we can login too.

Since moving from Scenario 1 to 2, we see some benefit, but here only change is in HMA settings

Since moving from Scenario 1 to 3, we see full benefit, but here only change is in Shamiko

Hence I raised issue about Shamiko and later HMA to the TG group.

From Github I saw dev for HMA is Dr-TSNG and also found her (him?) to be member of organization LSposed and so (wrongly) believed that all these apps are linked.

For some reasons, I can't join HMA TG.

yes, I do understand. If only some (easy) ways to find what they are looking for or have found...

I have no TWRP folder, Magisk Manager is renamed to Settings, included this renamed manager in HMA - blacklist template etc.

Yes, I had read about this, few weeks back, in this thread only.. think it was your detailed post on how to use HMA as people were confused.. Thanks for explaining again

One additional insight here, when I use Applist Detector (an app from dev of HMA) it says suspicious for "Abnormal Environment" and it raise this for XPrivacyLua - which I do use..But I have hidden it in HMA too for it to be not detected by Applist Detector and other apps. Screenshot attached. Anything to be done here...

I sincerely appreciate you taking time to write detailed reply.. am unlearning/learning here..
[Magisk] zgfg:
I'm not profound in XPrivacyLua (tried once and long ago) but you may test various combinations, incl. the uninstalled Lua

Btw, I remember that even upon uninstalling Lua, something still complained about its presence and I had to manually delete one folder (from /data) - info about that folder was on the Lua GitHub page or some link from there
[Magisk] pndwal:
Hi Gagan.

To avoid confusion, Rose is not real admin; she's a bot! ... Used in many groups... Not sure how real admins interact in LS TG however...

...but not main dev. 🙂

Further clarification:

We had EDXposed for some time. This was Elder driver Xposed Framework. Main dev was MlgmXyysd, a.k.a. Jaida Wu, Yuze Wu.

Seems her sister (literally?) Shana, aka LoveSy, Lovesykun, yujincheng08, disagreed about 'mandatory whitelist scope' early in 2021, there was a parting of the ways and LSPosed (LoveSy Xposed Framework?) was born as a 'forced-scoped' version of EdXposed.

Main LSPpsed Devs are:

- yujincheng08 (LoveSy)

- canyie

- Dr-TSNG (Nullptr)

- kotori2 (双草酸酯 Dioxalate)

- vvb2060 (南宫雪珊 Nangong Xueshan)

These LSPosed Devs collaborate on various projects. Authors are as follows:

- canyie: Shamiko, riru-Momohider, Dreamland

- Dr-TSNG: Hide My Applist, Applist Detector

- vvb2060: Alpha Magisk, Momo

Canyie is main admin for former Chinese Alpha Discussion thread, now called 西大師 家家酒 (West Master Xijiajiu). She and Dr-TSNG (Nullptr) are both more active there.

🤠 PW
[Magisk] mGforCe:
Ha ha, so you saw me being muted in the group :)

I know Rose is a bot, but someone would have triggered via writing command to her.. Typically they do by quoting member at fault and tagging rose and putting command like /mute, duration and reason. But here this was not visible. But then I was muted for 1 day, then another 1 day and then 3 days...back to back. I got to see their group log somewhere and translated to see comments.

Anyways, this issue is quite unique and there are too many devs and not easy to reach.

Wow..quite a lot of details. Guessing you can read/speak Chinese.

Think, am banned in HMA group already, without evening joining anytime prior. So no hopes.

Let's see if we get some solutions here on XDA. I am lil old school, not a fan of TG anyways - but sadly have seen all ROMs and related stuff moving to TG. So need to be there.
[Magisk] pndwal:
Yup... TG is fairly new to me; you are probably much more familiar...

Na; English only meself...

lSP group still has copying / forwarding disabled, so translation doesn't work in official Telegram and most other clients. It does in NekogramX however.

May have more joy on old 'Alpha' discussion group I mentioned as the two Devs, Canyie / Dr-TSNG (Nullptr), are both more active there as I mentioned... I'd post in Chinese (translated) and ask if it's ok to discuss Shamiko / HMA related issues there first however...

Tough lot... 😁😬🙁 PW
[Magisk] shadowstep:
I don't use that app, unfortunately. As long as you have found a working method for it, I suggest you stick to it even if it feels like overkill (unless you have time to spare and test what's the most minimal combination of hiding hacks that you need to use for it work). I also suggest making a post here with how you got it to work, in case someone else comes looking for ways to get that to work - always good to help! :)
[Magisk] m0han:
Just noticed: AppList Detector and Momo are back to flagging 'things Xposed'. (Oprek Detector continues to flag 'Custom Recovery Files' - reason unknown). @pndwal is gonna chide me for running LSPosed 'fly-by-night'lies, I know.

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-86684857
[Magisk] pndwal:
FWIW, my Momo hasn't changed (just updated to latest stable)... So thanks for heads-up; I'll avoid test builds this time...

Chide (since you asked for it):

If it ain't bleedin, don't make it bleed!...

But I know you're one of the mavericks; gotta be on the bleeding edge! PW
[Magisk] mGforCe:
Can you share pls the Alpha TG group? I will try there once..
[Magisk] mGforCe:
Sure, I will share the details

Edit: Posted here method with details to open Axis Bank app on rooted Android Phone. Thanks for the nudge & inspiration
[Magisk] mGforCe:
@m0han - hey, can you pls share how you have hidden xprivacylua from Applist detection?

On my Custom A11 rom, with latest magisk, magisk manager renamed + shamiko, lsposed etc along with xposed modules (HMA, xprivacylua, minminguard, xposed edge etc). Have used HMA to hide renamed magisk manager, other apps..

Still Applist Detector finds xprivacylua. What might be missing?
[Magisk] martyfender:
I have no such problems with the latest bleeding edge lsposed builds. However, after each update and reboot, I open the system.prop file in the lposed module folder, comment it out with a # at the beginning of the line, save, then reboot. I also use shamiko and enhanced mode for HideMyApplist, where I add apps to the template and effective apps.

In the lspoded app it shows as partially activated and that the system prop is incorrect, but it still works. On one of my devices momo shows a normal environment and on the newer, same device type with a newer Android 9 security patch date, it show with only the bootloader unlocked. Applist Detector flags everything a normal as well as Oprek showing healthy devices. I haven't tried xprivacylua.

I forget who posted this tip some time back. Maybe he will chime in. it might have been @zgfg? or @pndwal ?
[Magisk] juniorhero:
safety cts basic integrity false & profilematch false

in realme c25s ESI android 12

tried magisk alpha, magiskhide props & universal safetynet fix

what to do
[Magisk] zgfg:
I did repost that tip, somebody gave me over TG, I think it was @Stillhard

However, with Zygisk-LSPosed v1.8.1 (6499) - latest stable, not a daily build, there is no system.prop, no need to tweak and no corresponding issue in Momo
[Magisk] martyfender:
The latest stable is the only build I have not tried. Every cutting edge build I have tried has the system.prop file.

Update: I just tried the latest stable build Zygisk-LSPosed v1.8.1 (6499) and it still has the system.prop file for me. However, it could be left over from the previous cutting edge build? However I don't think so since it is no longer commented out.
[Magisk] m0han:
i would, if i could, but i don't use xprivacylua. maybe someone who does would.
[Magisk] zgfg:
It has been mentioned/confirmed in couple of posts probably a week ago

Screenshot with the content from my module attached below

Edit: Latest daily 1.8.2 (6512) contains the system.prop again
[Magisk] m0han:
i'd do that too, but, there is no system.prop file (for me) with the latest nightly. also reported quite sometime back.
[Magisk] martyfender:
Maybe it is device, android version specific? If you unzip the module installer zip, system.prop is there. When you open the lsposed app what shows there?
[Magisk] pndwal:
Replied

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-86755353 PW
[Magisk] pndwal:
GSI?

Is Zygisk working / enabled for you?

Which USNF version?

Tried clearing Google Play Services data?

Tried with only USNF and MHPC modules active? (Some modules break Basic Integrity.)

Nb. Basic Integrity can be a ROM issue also.

GSI / DSU / Treble implementation is particularly difficult, and a WIP for Magisk, especially in Android 12.

John committed some changes for compatibility even years back and Shana + others are making ongoing improvements.

This commit was merged 13 March:

Refactor 2SI to avoid changing mount point from /system to /system_root #5146 so it's only in recent Canary builds.

It also appears that official Google GSIs can work where PHH (and other?) GSIs have issues.

https://github.com/topjohnwu/Magisk/issues/5432#issuecomment-1059536668

Because of this and other recent fixes, if nothing else works you could try latest Canary Magisk build. PW
[Magisk] m0han:
didn't quite get you, but check the screenshot. i'm running crDroid A12.1 rom on Poco X3. but, maybe the situation was the same on A11 rom too. i think i was the first to report(?) 'system.prop not found'.
[Magisk] zgfg:
system.prop is present in the zip file for the latest stable Zygisk-LSPosed v1.8.2(6519) as just updated, but quickly looking to the customize.sh, seems that system.prop will be installed only for Pie and older - that's why you don't have when you install the module
[Magisk] m0han:
sometimes it is no good being a m@ver!ck. see my post here. that stopped working when i updated to the latest nightly (6522). got it back working only after i went back to the latest stable (6519). lesson learnt.
[Magisk] daemonicvs:
ok, so the applist detector by hide my applist shows xprivacylua unter "abnormal environment". the readme says its because of the folder /data/system/xlua. maybe thats why some banking apps still detect root resp. they say i got to update google play services (i wont, i got no google trash and i wont get it and i tried it with microg and props cfg etc but nothing works so i delete microg again and i wont use it anymore)

i renamed the folder but after rebooting theres a new folder /data/system/xlua with an empty db-file and the xprivacylua settings are gone. so i think xplua needs the exact foldername/path wiht the db-file to store its settings. someone got a solution for this?

does someone know if the apps (icard, bitstamp) detect root through the xprivacylua-folder or do they just detect that i got no google/cia spyware "services" on my phone like they claim in there error messages? all other (banking) apps work without the cia-crap. of course yasnac say that the installed google play services is not authentic. but with microg it says it as well. btw... i use xiaomi redmi 4x havocOS 8.3.