yashsingh1/xdaforums huggingface dataset:
[Magisk] Lord Sithek:
Thanx, althouh personally I use HMA and LSPosed extensively, as I explained in the next post ;) But it may prove useful for some other users
[Magisk] dohanin:
I need some advices from the experts here.

While I successfully run the latest Magisk in my phone (A12), I installed the same on my other device (MiPad 4) but the behaviour is quite different in terms of hiding root. Below are the differences:

Device 1: Android 12, stock rom, stock recovery, Magisk Canary 24101+USNF2.2.1+Shamiko v0.1.2-47+InitRCHider

MagiskDetector: nothing detected

Momo: Bootloader unlocked

RootBeer: NOT ROOTED

Device 2: Android 10, Carbon rom, TWRP, Magisk Canary 24101+USNF2.2.1+Shamiko v0.1.2-47+InitRCHider

MagiskDetector: su file exists in Path; Magisk Hide is not working

Momo: Found Magisk; Data not encrypted, mount parameters are modified; Device is running a custom ROM; Bootloader unlocked.

RootBeer: ROOTED (failed SU Binary, 2nd SU Binary check, For RW Paths, Root via native check, Magisk specific checks)

Updating Shamiko to the latest makes no difference.

And the strangest thing is that, there is one particular app that would not work on Device 1 can run on Device 2! I don't have any clues.
[Magisk] zgfg:
I use HMA mainly for detaching - hiding from Playstore

Like YouTube (for Vanced root) and Android Auto (for CarTube, Screen2Auto, Fermata) - must make sure that Playstore does never (even by my mistake) update those apps from particular versions
[Magisk] Robbo.5000:
Some apps will search your phone for known, common apps that require root. Some apps will look for a TWRP folder.

If renaming the TWRP folder doesn't help, then you may need to go down the path of hiding all root apps from the bank app, using HMA. I'm fortunate enough not to need it, yet, so can't point you in the right direction of how to correctly configure HMA.
[Magisk] kelvinchinedu:
Flash safety net, enable zygisk, add Google to deny list,. Still unable to pass safety net on v24 running android 11 custom rom. Any help?
[Magisk] oulouloul:
Yes exactly. I've give up now. I don't use banking app. I'm happy with root and lsposed. Thank you again for all your effort for me
[Magisk] Lord Sithek:
Huh, me the same - I hide from Play Store YouTube, SwiftKey & Google Photos 🙃
[Magisk] Robbo.5000:
Install and run the MaguskHide Props config module. Instructions are in it's github readme. Running official LOS on a Redmi Note 6 Pro, I needed to do this extra step to set the fingerprint to match the actual device. Was good afterwards.
[Magisk] nourpon:
Thank you a lot.

I restart from the beginning and wipe all, flashed magisk in recovery and everything work fine.
[Magisk] kelvinchinedu:
As u can see I already flash props but not working
[Magisk] svendsvin:
I'm on Xiaomi MIUI 12.5 stock rom. Very smooth update to 24.1. Followed https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-86321719. Only hiccup was when I forgot to hide Magisk and one of my banking apps (NemID) malfunctioned. After hiding Magisk everything works as in 23.
[Magisk] kramer04:
For users Samsung have zygisk NO change this

init.rc : changed persist.sys.zygote.early to false

Reboot and zygisk now toggled to on

test safetynet with YASNAC : all is ok

For example i can now run my banking app

A good idea would be to make magisk module to do that.

But i don't know how to create it
[Magisk] Skorpion96:
What you guys want to know what is my problem with zygisk, I was using SudoHide but now with zygisk the blocked apps are seen from play store even if SudoHide is set correctly so is lsposed zigysk problem i think, it's not good to say but the normal detach don't work always, sometimes the app I detach are updating again, with SudoHide I have resolved the issue but now with zigysk don't work anymore.
[Magisk] nacos:
Thanks for sharing. The suggested XPosed module is much better than I thought. Not only it hides root but it can hide any app from any other app - great flexibility. 👍
[Magisk] ColinHu:
Yes, they are on network. Not bloce on anything. Now I'm trying to factory reset the phone, and redo all the work to see how it goes.
[Magisk] zgfg:
Test SafetyNet before rooting - it will fail bcs of Bootloader locked but should not fail due to timeout

Also, SN is passe, G is switching now to Play Integrity API - it was written a lot here on XDA about, you can find the Checker on Google Play (try to use Google Play to make sure your G account works)
[Magisk] ColinHu:
It's working now. Passed the safetynet check. But just cannot use those banking app, and other apps.
[Magisk] zgfg:
You have to use "safetynet-fix-v2.3.1-MOD_2.0.zip".

You have to put 'banking apps' to DenyList

You should try with Shamiko (in that case DenyList must not be enforced)

You have to try with HMA (not easy to setup but it was desussed/described in posts in various threads here on XDA)

'Banking apps' is too generic - diff apps from diff developers may use different additional methods to find/guess about 'root' (some may look for TWRP folder, etc)

All these things have been discussed fully or partially in certainly hundredth or more posts (some guiding specifically for particular banking app, for a particular ROM, etc) - hence please excuse me but I will not advice further
[Magisk] ColinHu:
I tried all the things that you mentioned above, but still the app not able to work. The bank app works, but not for pokemon go. Every time I login in pogo with g account, it just login in the g account, then nothing happens.
[Magisk] pndwal:
Please say results of Play Integrity API Checker app... If deviceIntegrity is passing, please say what root hiding (ie. which root traces) forums say are needed for your game... Also, please list clearly all root hiding methods you have implemented...

With this information I'll try to help / others may be better able to offer suggestions... 👍 PW
[Magisk] fallenone189:
Redmi note 10 pro user here, im using magisk+shamiko. Just today there was an update to hdfc bank app and it detects root. Tried everything, including getting saftey net mod version. Momo finds zygist and zygote. While applist detector finds some file in magisk.

Any fixes to get hdfc bank app working again? Below are the screen shots of the apps. Any help is appreciated
[Magisk] pndwal:
Please say results of Play Integrity API Checker app...

If you now have deviceIntegrity pass, have you cleared bank app data since installing @Displax USNF fork? PW
[Magisk] 73sydney:
Step 1: Remove Momo and never quote it here again under pain of death :)
[Magisk] fallenone189:
My device fails strong integrity, I have attached the screenshot below.

After installing the USNF fork I reinstalled the app and wiped the data, same result.😔

This place made me discover momo😂
[Magisk] pndwal:
deviceIntegrity is enough...

Have you taken Hide the Magisk app in Magisk settings?... Assume app is in denylist? (Nb. w/ this disabled and Shamiko working it actually becomes a hidelist.)

You may need to hide Magisk further as well as other root apps... Installing LSPosed and Hide My Applist module commonly works...

Ensure you use 'parasitic' LSP Manager... May need settings toggle set to bypass launcher icon detection... Add bank app to HMA App manage list and configure a blacklist template incl. Magisk hidden stub app you named (this is still detectable by employing tricks otherwise), HMA itself and any other Zygisk modules as well as any root apps you have (any may be suspicious to bank). May possibly need to hide detection, checker apps and other apps you suspect bank might look like for...

Nb. You should clear bank app data before testing any fix or change.

Nb. 2. This works for many, but there are many apps that also detect Zygisk or other traces of root in the wild...

🤠 PW
[Magisk] huskydg:
What is your banking app? Shamiko no longer update and can't fool some apps that detect zygisk (livin by mandiri, instapay Egypt, itsme, picpay, picpay,...)
[Magisk] dr4go:
not? 😱😜😇
[Magisk] fallenone189:
THANK YOUU! This worked flawlessly! Banking app works now and the magisk hidden stub app dosent show up on applist detector! You saved me from having to go rootless 😂👍

Banking app is HDFC mobile app. The issue is fixed now, thanks to @pndwal.

If I give up on zygist, how do I hide root and magisk from other apps? Hide my list works for hiding root too?
[Magisk] huskydg:
Inject zygote like Zygisk causes detectable and not all apps check for it. As i discovered that there are livin by mandiri, instapay Egypt, itsme, picpay, picpay, sitech, zaincash, chinese games, flawry,... You can only use old good non-injection hiding MagiskHide or modded Riru MomoHider
[Magisk] pndwal:
I just updated ItsMe Belgium ID app to latest version 3.11.0 and tried again (it was detecting 'root' maybe 3 months ago)...

Interestingly it doesn't seem to be detecting root/mods now with my latest Canary w/ Magisk any more!:

... Perhaps a Shamiko update has fixed some detection bypass?

Nb. I haven't tested any other apps on your list...

Side note: Interestingly Momo has also started detecting unit.rc again recently...

🙃 PW
[Magisk] huskydg:
@pndwal livin by mandiri, instapay and few apps has been updated to detect zygisk again even you have shamiko 0.5.2, but itsme not update yet
[Magisk] huskydg:
Then it will be updated to detect again, just like livin by mandiri and instapay Egypt in recent day. The game will end.
[Magisk] pndwal:
🤔... It was on you list for 'checking for Zygisk' / "You can only use old good non-injection hiding MagiskHide or modded Riru MomoHider"... I tested latest version as stated... I don't know what to say... PW
[Magisk] huskydg:
You already see, Shamiko seems to have not update for a long time while detection is constantly updated. I mean if these apps in future, you can't fool it by zygisk. And Livin by Mandiri seems to can't be bypassed at the momment unless unload Magisk.

I knew you are happy with zygisk but honestly the game will end soon
[Magisk] huskydg:
Another app that detect zygisk

玉山行動銀行 - Apps on Google Play

Jade Mountain Mobile Bank provides you with convenient fingerprints and graphical passwords for financial services, one-slide login to super fast graphical accounting information, swipe browsing, clear and real-time message push, account control is convenient and secure

play.google.com
[Magisk] prokiller1199:
Hi good day, can anyone help me on this app after updated on play store and not working anymore. Was working fine before. Thanks

PB engage MY - Apps on Google Play

Offers you the most convenient personal banking with us.

play.google.com
[Magisk] 73sydney:
Tested just now, this is as far as i can test without an account anyways

1) do you have the app in Deny List?

2) do you have Shamiko installed (and Enforce Deny List disabled)?

If you havent gotten this far, consider either clearing app data or uninstalling and clean installing the latest version of the app (dont forget to add to Deny List)
[Magisk] prokiller1199:
Yea this is the correct page to reach when it's fine, for me after the banner then it just crash. Yours is indeed working.

1) Yep, I did have it in Deny List since the beginning.

2) and yes. But don't know why suddenly it just dead.

Uhm, maybe I'm using android 13?
[Magisk] pndwal:
Guess bank app was updated... Banks are moving to new Play Integrity API as S/N is now deprecated...

Best fix now is @Displax's unofficial Universal SafetyNet Fix w/ fix for PI deviceIntegrity verdict... You need his latest revision if your device launched w/ A13 (Pixel 7 series etc)... (You seem to still have official USNF...) 👍 PW
[Magisk] prokiller1199:
Okay, I'll try with https://github.com/Displax/safetynet-fix/releases first then report back. Yes was using official USNF since the phone was bought and unlocked.
[Magisk] pndwal:
PSA:

Incidentally, for

anyone using Hide My Applist

LSPosed module with Android 13, only 3.x.x series (currently Beta only) has proper A13 support...

Nb. Be sure to uninstall the Magisk extension module (no longer needed) per release notes to avoid bootloop...

👀 PW
[Magisk] prokiller1199:
I just tested the module, and its behaving the same. I wonder what the app is detecting after update...
[Magisk] shoey63:
Most likely zygisk. Quite a few apps are finding it now, and no real way to hide it
[Magisk] prokiller1199:
But don't know why @73sydney is working tho.
[Magisk] pndwal:
Checked you have deviceIntegrity pass in Play Integrity API Checker, then cleared Bank app data before testing?

Also, please say/screenshot Momo results... PW
[Magisk] prokiller1199:
Yes passed, and cleared and reinstall fresh.
[Magisk] pndwal:
Haven't taken Hide the Magisk app settings option?... Do that and try with debugging disabled in developer options...

Clear bank app data for each test... post Momo results again... PW
[Magisk] prokiller1199:
After hiding Momo in Magisk app and turn off usb debugging in developer options.

It says zygote is injected and idk what it means.
[Magisk] 73sydney:
im on stock Samsung A12....
[Magisk] prokiller1199:
Im on stock pixel 6 A13
[Magisk] zgfg:
Zygote - Zygisk starts from Zygote

Somebody already answered you that several apps are detecting Zygisk now, and that there is no full-proof way to hide that

AFAIK, for everyone here Momo (closed source) will detect Zygisk.

One of the reasons that some also ask here (politely and less politely) to stop referring to Momo😁

Of course, banking apps are closed source and you can never know what they detect and how.

Therefore, one user, with his setup may skip under the radar, the other with different phone, ROM, etc will be caught

Some people have also suggested a 'radical' solution - to go back to MagiskHide (by use of eg Magisk Delta)

Formally, Magisk does not guarantee any hiding - to the contrary, TJW has distanced himself😀
[Magisk] pndwal:
I think hooking is detected... Does screenshot show all modules? ... Nb. Your LSP (xhook) is from early May... Latest Stable is 1.8.4-6609... To hide hooking in A13 you may need late beta / nightly (now 1.8.4-6633) but I'm not sure... Could be Zygisk xhook too ... You could test that...

Did you actually take 'Hide the Magisk App' option to obfuscate the app?... Cos looking back you didn't confirm, and it's often essential... Many banks can bypass this also, so may need both hidden (stub) app and further hiding...

Hide my Applist LSP module is a convenient method... May need to hide Magisk and all root apps / managers / utilities/ LSPosed modules etc for some banks... Also you'll need latest beta (3.x.x) release for A13... (HMA now also hides /data/data for A11+)

See:

- https://xdaforums.com/t/discussion-magisk-the-age-of-zygisk.4393877/post-87608273

- https://xdaforums.com/t/discussion-magisk-the-age-of-zygisk.4393877/post-87623757

Nb. Some, all of or more than the above detection types may need bypasses...

Wanna play cat and mouse? 😜 PW
[Magisk] prokiller1199:
Yeah thats my only modules from screenshot.

Before that when it is working i have to uninstall magisk manager to work (what I mean even hiding magisk manager still detected). Now even after uninstall but its still detected something.
[Magisk] Mr.Jlu:
Hi Guys,

I found the checks the HDFC Bank_11.1.5 app is performing for checking the root status, most of the stuff is obfuscated but we can get a glimpse of what is going around in the background.

Any suggestion to bypass this is much appreciated.

package com.backbase.android.core.security;

import android.content.Context;
import com.backbase.android.core.utils.DoNotObfuscate;
import com.backbase.p006a.C0843b;
import lxl.C6232aa;

@DoNotObfuscate
/* loaded from: classes2.dex */
public class RootVerification {
private C0843b rootUtils;
private boolean rooted;

public RootVerification(Context context) {
this.rootUtils = new C0843b(context);
}

public boolean isRooted() {
return this.rooted;
}

public RootVerification withBinaries(String[] strArr) {
int length = strArr.length;
int i = 0;
while (true) {
if (i >= length) {
break;
} else if (C0843b.m10159a(strArr[i])) {
this.rooted = true;
break;
} else {
i++;
}
}
return this;
}

public RootVerification withBusyBoxBinary() {
this.rooted = C0843b.m10159a(C6232aa.m1119a(22896));
return this;
}

public RootVerification withDangerousProps() {
this.rooted = this.rootUtils.m10156b();
return this;
}

public RootVerification withDefaultCheck() {
C0843b c0843b = this.rootUtils;
this.rooted = c0843b.m10157a((String[]) null) || c0843b.m10155b(null) || C0843b.m10159a(C6232aa.m1119a(22897)) || c0843b.m10156b() || c0843b.m10154c() || C0843b.m10160a() || C0843b.m10152d();
return this;
}

public RootVerification withPotentiallyDangerousApps(String... strArr) {
this.rooted = this.rootUtils.m10155b(strArr);
return this;
}

public RootVerification withRootCloakingApps(String... strArr) {
this.rooted = this.rootUtils.m10153c(strArr);
return this;
}

public RootVerification withRootManagementApps(String... strArr) {
this.rooted = this.rootUtils.m10157a(strArr);
return this;
}

public RootVerification withRwSystem() {
this.rooted = this.rootUtils.m10154c();
return this;
}

public RootVerification withSuBinary() {
this.rooted = C0843b.m10159a(C6232aa.m1119a(22898));
return this;
}

public RootVerification withSuExist() {
this.rooted = C0843b.m10152d();
return this;
}

public RootVerification withTestKeys() {
this.rooted = C0843b.m10160a();
return this;
}
}
[Magisk] huskydg:
It looks like RootBear check, easy to be bypassed
[Magisk] amritpal2489:
Actually its not at all easy... Tried every trick in the book but no resolution
[Magisk] spiritforme:
How to install xposed with zygisk? I have been installed lsposed but it still can't be used
[Magisk] Jay_B:
Can you please advise what you did to bypass the check? Thanks
[Magisk] 73sydney:
please describe exact steps taken and errors if any (screenshots if possible)
[Magisk] zgfg:
Isn't that eg advised in the OP posts on the first page (I didn't check now but I think I recall from the time when Magisk v24 and Zygisk were brand new)

XPosed is long ago deprecated. Use Zygisk-LSPosed instead

Releases · LSPosed/LSPosed

LSPosed Framework. Contribute to LSPosed/LSPosed development by creating an account on GitHub.

github.com
[Magisk] VStephen:
How to boot into magisk when ramdisk is no
[Magisk] pndwal:
Please say device...

You may need to patch recovery ramdisk instead of boot ramdisk but not necessarily...

It's assumed you need recovery mode Magisk (see Magisk in Recovery in Installation Instruction page), but most Xiaomi and some other devices still accept boot mode...

Ramdisk = No means no OEM supplied ramdisk in boot partition, however Magisk actually adds basic ramdisk if its missing (when patching), and in some devices this works as bootloader is strangely compatible with ramdisk in boot despite OEM not utilising this... The only way to know if you have this anomaly to take advantage of is to see if patching/flashing boot.img works... or learn this from others rooting same device...

Nb. Magisk continues to display Ramdisk = No... Also, in such devices (A-only legacy SAR boot type circa 2018, 2019) where boot mode Magisk is not supported by bootloader your only choice is to patch recovery.img and use special key combo to boot to system w/ Magisk via recovery per John's instructions...

🤠 PW
[Magisk] simplydat:
Hi Huskydg,

I have his esunbank and the latest version v.4.5.8 no longer works even with Shamiko. Is it because Shamiko can't hide Zygisk?

First of all, how do you know it added Zygisk detection? Is there a way to tell? I'd like to learn how apps are detecting root for future references.

Second, are you able to overcome this new root detection?
[Magisk] huskydg:
Yes
[Magisk] simplydat:
1. How do you tell it's detecting Zygisk?

2. Any way to overcome this?
[Magisk] huskydg:
Shamiko cannot hide zygisk

Because it works when disable Zygisk

Yes, just do not use Zygisk
[Magisk] simplydat:
Thanks for the answer. I assume switching over to Magisk Delta with Magisk Hide instead can solve this problem?
[Magisk] huskydg:
Or you can use Riru + Riru Momohider on official Magisk

GitHub - HuskyDG/riru-momohider: A Riru module tries to make Magisk more hidden. http://github.com/canyie/riru-momohider

A Riru module tries to make Magisk more hidden. http://github.com/canyie/riru-momohider - GitHub - HuskyDG/riru-momohider: A Riru module tries to make Magisk more hidden. http://github.com/canyie/r...

github.com
[Magisk] huskydg:
Try patching boot image like this @pndwal used to say
[Magisk] prokiller1199:
Quick Update:

Today the app is updated and once again it's working LoL Thank god. Nothing change from my side except updating some modules. Maybe something wrong with the app earlier.

@73sydney @pndwal @shoey63 @zgfg

Thank you guys for the input and comment. Appreciate it!
[Magisk] ywami:
Is it just me, or I'm the only one with Momo finding absolutely nothing except for bootloader unlock but cannot pass any Play Integrity criteria? I do have the modded USNF module installed. SafetyNet also pass. All apps (including banking) work fine so it's not really a problem, I'm just curious 🧐
[Magisk] huskydg:
Not all banking apps use safetynet or play Integrity check
[Magisk] DenisJ:
Hi there all,

I have some problem with the Revolut Card application.

I use a stock rom of Redmi 10 Pro Note with boot.img patched via magysk

Then I installed Uneversal SafetyNet Fix v2.3.1-MOD_2.0

Zygisk installed and the Revolut APP I put it in the denny list.

"Enforce DenyList" is not activated...

I pass the first 2 points of "Integrity checker"

But the Revolut APP tell me that is detect ROOT:

Anyone can give some idea please ?

Thanks in advance

Denis
[Magisk] J.Michael:
Enforce Denylist

I think the only time you put things in the deny list but do not enforce deny list is when you have Shamiko module. Otherwise, what's the point of putting anything in the deny list?
[Magisk] DenisJ:
GREATTTTT !!!

I "Enforce Denylist", then I clean data on Revolut APP, restart the phone and...

...now it's work :-)

I have installe days agon the Shamiko module and I think that in some place I have read that the "Enforce List" must be unchecked. So for this reason it was unchecked.

Now it's on and the APP it's work :-)

Thanks so much

Denis
[Magisk] J.Michael:
If you had Shamiko and you wanted to use Shamiko, then you were right to not enforce Deny List in Magisk.

There might be a setting in Shamiko. Start by checking to see what the Magisk list of modules says in the Shamiko entry. I've seen screenshots indicating that Shamiko has a mode (something like "blacklist" vs. "whitelist"). That could have been your problem.

On the other hand, you seem to have fixed it, so if it isn't broken...
[Magisk] asripath:
Interesting...

Have been using shamiko magisk module..

Never saw a UI for it ...

How does one access Shamiko settings, whitelist/blacklist ?
[Magisk] J.Michael:
Not sure, never used Shamiko. The way Shamiko coattails on Magisk, using Magisk's Deny List, it's likely Shamiko has no UI.

See if you can find a post in this or the main thread that mentions blacklist vs. whitelist. Then at least you'll know whether I'm remembering something about Hide My App.

This post has a screenshot of the Shamiko entry in Magisk manager app's module list, saying "Shamiko is running in blacklist mode." Maybe I made up "whitelist" as the alternative, and Shamiko is really either in blacklist mode or not running. Or maybe when Shamiko is enabled but not using the Deny List, it's still doing something. Get thee to a Shamiko thread.
[Magisk] asripath:
The screenshot you ref to is the description of a module.

Magisk shamiko does not have a UI.

Thought you found a way to setup/configure it via CLI.

Looks like you meant HMA.
[Magisk] J.Michael:
My thoughts, exactly.

Then I found this external page that said Shamiko's whitelist mode can be enabled by creating a file with a magic name. (And I had probably seen the same thing in an XDA post.)
[Magisk] asripath:
Good find.

Though not sure it is helpful in stopping root detection...

looks like it prevents additional root requests.
[Magisk] huskydg:
shamiko whitelist is useless and cannot prevent detection
[Magisk] J.Michael:
Not the point. Original question was "where is the UI to select whitelist vs. blacklist?"
[Magisk] huskydg:
Create /data/adb/shamiko/whitelist