yashsingh1/xdaforums huggingface dataset:
[Magisk] Spartacus500:
Magisk 27.0 stable (with a random name)

Modules :

- Shamiko 1.0.1

- PIF 15.7.2 (chiteroman)

- Magisk uds by pass

- Fake encryption

- Fake SELinux Permisive

- Init Rc Hider

- Smali Patcher

- Lsposed 1.7.2 + HMA

Only add Payback to Magisk denylist & works.
[Magisk] samhhmobil:
OK let's see...

I'm now on the XA2, NOT rooted, no magisk, clean install of LineageOS21, with formatting data.

Device integrity and basic integrity pass.

Just only strong integrity and virtual integrity do not pass (as expected).

Momo detects custom rom and unlocked bootloader. OK.

But rootbeerfresh and S-Check have false positives: they detect root, but there is NO root.

How to circumvent that?

(Of course I want to install magisk and all necessary modules later, but step by step...)

samhhmobil
[Magisk] dipseeet:
moin sam :)

phone

kitsune

lsposed
[Magisk] samhhmobil:
OK, you're on Android 12. Up to 12, I even didn't have had any trouble, but with LineageOS 20 (and even 21), it doesn't seem to be as simple as before, there must be something fundamental in the interaction with magisk/zygisk, that has been changed...

Even if all other checks are "green", Device is certified, TB-Checker cannot find anything,.... but S-Check detects something, which is interpreted as root (yes: sys.oem_unlock-allowed is set to 0). It does find this even on a phone LineageOS21, that really is not rooted. — Up to LineageOS 19.1 (Android12L) this was "green" too.

samhhmobil

Edit:

Does somebody knows, what the "Error: 107|204|250" is meaning in detail?
[Magisk] Spartacus500:
@samhhmobil

Try install this module

GitHub - Magisk-Modules-Alt-Repo/sensitive_props: Reset sensitive properties to safe state, take from MagiskHide code

Reset sensitive properties to safe state, take from MagiskHide code - Magisk-Modules-Alt-Repo/sensitive_props

github.com
[Magisk] samhhmobil:
Thanks.

I tried, but... it didn't help (as I did expect).

Because: SafetyNet and PlayIntegrity did pass before, even without this module.

There must be another issue, something basic... that exists even without magisk (but of course I need magisk to fix it... if I would know, what it is).

samhhmobil
[Magisk] samhhmobil:
It seems, we have to identify, what's the issue on unrooted LineageOS(20, 21)-phones, which is falsely detected as root by S-Check,

and it seems, we have to identify, what's the issue on unrooted LineageOS(20, 21)-phones, which is falsely detected as insecure by “Payback-app 24.xx.xxxx”.

And... it's not guaranteed, that it's the same issue (but I hope, it is).

After that, I (or we?) have to find out, with which help of which module in magisk I (or we?) can circumvent that.

I don't have any new idea yet,

any help is appreciated.

Thanks,

samhhmobil
[Magisk] J.Michael:
Is unrooted LineageOS 19 falsely detected by S-Check and new Payback?

Are you in a position to test a GSI image? Some third ROM? (Not what comes from the manufacturer, not Lineage.)
[Magisk] samhhmobil:
First one... yes, I'll do a downgrade to LineageOS19 (including factory reset) on my spare phone Xperia XA2 (H3113, pioneer).

Second, if you can assist me, the device for tests is the XA2. Then I'll try.

(Of course I can convert back to Sony's StockRom, but it's really old, it is Android-9.)

samhhmobil
[Magisk] Wolfcity:
A9 is old? In my world old is something like 7.1.2....but I'm old too.:rolleyes:

But seriously: On the other side, isn't S-check a pretty old app? I know your problem exists, so the app may be not be the problem.

I'm using the German payback app randomly too, for me it's enough to put it on magisk 27's deny list, no other modules needed.

But I'm certainly rooted and have no idea why your device is recognized as rooted when it isn't?
[Magisk] J.Michael:
I won't be of any help, I've never installed a GSI. I don't know whether you just download one and install it, or you have to build it yourself with a big slug of device-dependent crap.

A really old stock ROM is still a manufacturer's ROM. I was wondering whether what's tripping S-Check and Payback was just the fact that you are running a "not manufacturer's" ROM. I have no idea what could give it away.
[Magisk] samhhmobil:
I made the first step back a little bit bigger, and downgraded to LineageOS 17.1 (Android 10) with good old OpenGapps nano.

Formatted all partitions, system, data, internal storage, dalvik/cache, in both slots, a and b.

The device is NOT rooted.

PlayStore says: Device is certified!

Nothing else was installed, just only:

- Play Integrity Checker (Device and Basic pass)

- S-Check (the same: root NOT passed)

- YASNAC (Device and Basic pass)

- TB-Checker (everything is green, BUT: "Dangerous Props: Fail (X)" )

And... (as to expect yet): Payback app is blocked.

So long for today.

samhhmobil
[Magisk] samhhmobil:
Next try...

All as before, plus:

- Magisk 25.2 (good old one for Android10)

- hidden,

- Busybox 1.36.1

- Shamiko v0.6(126)

- USNF v2.4.0-MOD_2.0

Result:

S-Check is completely green, no root detected, yeah!

Momo4.4.1 just only detects unlocked bootloader, and device is running a custom rom.

But:

- Device is NOT certified in PlayStore,

- Device passes Basic integrity

- But Device passes Device integrity in YASNAC (why ???),

- but neither in TB-Checker, nor in Play-Integrity-Checker.

Nevertheless, everything else in TB-Checker is green (without strong and virtual integrity, of course).

"No Device integrity" seems to be due to newest version of GPS with PI checks, (to the good old times, I did use Android10, long ago, this device did pass, years ago).

... Payback app does not work (even as expected).

samhhmobil
[Magisk] Spartacus500:
Try uninstall Busybox module & test
[Magisk] samhhmobil:
USNF reinstalled.

PIF 15.8 installed.

Now "Device is certified"

...and: S-Check stays green on all tests. Yeah.

All other Test-apps pass green.

Payback cleaned (cache and data)

GPS cleaned (cache and all data)

Payback de-installed, and new installed:

...and... Payback even does NOT work, sigh.

What else can I do?

samhhmobil
[Magisk] samhhmobil:
Did it. Now I have only "shamiko“ and "pif 15.8".

All tests are green, device is certified.

But... even new installed payback (again added to deny list) does NOT work.

What the hell do they check more?

Unlocked Bootloader? How do I hide that?

("sys.oem_unlock_allowed" is set to 0)

samhhmobil
[Magisk] Spartacus500:
I'm afraid this is the root cause in your Rom 🤷
[Magisk] Spartacus500:
@samhhmobil

Try test this app, first add to denylist Magisk.

For me it only shows that there is a modification to init.rc, and Momo_v4.4.1 says no, strange 🤔

GitHub - RabehX/Securify: Yet Another detection application.

Yet Another detection application. Contribute to RabehX/Securify development by creating an account on GitHub.

github.com
[Magisk] samhhmobil:
Interesting...

For me Securify just only detects:

"Device is running a custom rom."

Nothing else...

(Momo detects "unlocked bootloader" too...)

...and on my daily driver (Xiaomi gauguin), LoS20(A13), Securify detects:

- custom rom

- Hosts file has been modified

But there Momo detects:

- custom rom

- init.rc is modified (which is NOT detected by Securify)

- unlocked bootloader

samhhmobil
[Magisk] pndwal:
Dev credits LSP Devs for code... Init.rc was giving false positives in MagiskDetector before that was deprecated... See Canyie's comments about result being unreliable (detects 'init.rc modified' even when Magisk isn't installed!):

https://github.com/canyie/Riru-MomoHider/issues/12#issuecomment-907718098

... Vv originally said MagiskDetector wouldn't be fixed as she was spending all her time fixing Momo which was always closed source so I'm guessing your dev just borrowed old MD code not realising it's unreliable. 👀 PW
[Magisk] SamsungN:
where can I get shamiko? Also im not tech savvy but I downloaded Magisk and it has zygisk-LSposed as a module is that something I can install on top of Shamiko?
[Magisk] o0otnto0o:
Releases · LSPosed/LSPosed.github.io

Contribute to LSPosed/LSPosed.github.io development by creating an account on GitHub.

github.com

Keep in mind it's a closed source. I also didn't need it with my Galaxy S24+
[Magisk] SamsungN:
Im not sure what closed source means. But is this something I can install with Magisk 27.0 that has Zygisk-LSposed as a module?

I just want to accomplish installing Shamiko, Hide my app list, and install Android faker because the app detects my Samsung Tab S7 FE serials
[Magisk] prokiller1199:
Hi can anyone test this app for me.

OCBC Digital - Mobile Banking - Apps on Google Play

Access mobile banking services easily through the OCBC Digital app.

play.google.com

I'm running latest march update and latest kitsune mask canary, seems like after my ota then it broke the app.
[Magisk] Spartacus500:
Install this app & check root

But, after add to denylist Magisk 27.0 stable & open ok
[Magisk] prokiller1199:
Thanks I guess it's because of I'm using canary version.
[Magisk] Ex novo:
Porto: Seguros, Cartão virtual – Apps no Google Play

Peça seu Cartão Porto Bank, o único que paga o IOF das suas compras no exterior.

play.google.com

This app stopped working on my devices after an update. Somehow it is detecting root. I tested on 2 phones, one with LineageOS 19 and other with Pixel OS (android14). I have Magisk stable version 27 installed, Magisk app hidden, Zygisk activated and applying the deny list. Additionally, I have Play Integrity Fix module version 15.9 installed. Gpay works and banking apps that detect root also work. Only this app refuses to work.

Any suggestions to resolve this?
[Magisk] sawdoctor:
Have you tried shamiko?
[Magisk] Ex novo:
Okay, I'll try, thanks.
[Magisk] 1jkan:
Magisk cannot be renamed in today's Canary build update. Error message appears. Is there a way to do this?
[Magisk] sawdoctor:
There's several bug reports on GitHub about it so I'm sure they are aware of it. Either wait for the fix to be pushed, downgrade or use the debug version as the debug version is working properly
[Magisk] jimger:
Could someone check with

Santander Pilot - Apps on Google Play

Santander mobile banking pilot

play.google.com

Crashes for me. Other bank apps work OK.

Magisk alpha latest, lsposed latest, zygisk of magisk alpha, hma latest and shamiko
[Magisk] xcl1pse:
Bruh
[Magisk] jimger:
Could someone check with

Santander Pilot - Apps on Google Play

Santander mobile banking pilot

play.google.com

Crashes for me. Other bank apps work OK.

Magisk alpha latest, lsposed latest, zygisk of magisk alpha, hma latest and shamiko

Thanks much, pretty strange. So, probably I should uninstall. Thanks much
[Magisk] Spartacus500:
Same for me, open crash 🤷
[Magisk] jimger:
I tested Starling banking app. Also fails. It seems they are Able to detect root again. Thankfully most my normal banks are ok
[Magisk] jimger:
For me it doesn't. Which magisk etc u got? Which device?
[Magisk] xcl1pse:
All my device can open starling without problem. Some of them using magisk alpha, the rest using TJW magisk. Also have Oplus device but that isn't on OOS or COS. Already inspecting all modules you have to find the problem?
[Magisk] jimger:
I haven't I will disable some and check...
[Magisk] KennethYoon91:
Anyone updated/installed RHB Mobile Banking Ver, 2.15.1? does it work with HMA and denylist enabled?
[Magisk] Spartacus500:
For me not working, open & crash 🤷
[Magisk] xamtra:
I fully support the idea of rebooting. My bank app was not working until I rebooted my device.
[Magisk] KennethYoon91:
mine not working on my other device, guess i just stay on current version till solution being found.

Mind to share your Magisk and HMA settings., also does your playstore intergrity chacker passed?

My Mcd app recently stop working until i update playstore intergrity fix module.
[Magisk] xcl1pse:
McD require your device to pass play integrity (on DEVICE INTEGRITY test). So yea you need Play Integrity Fix. Apparently PIF latest by chiteroman include the fix for that in the module rather than finding for your self + fix for not passing BASIC and DEVICE on some devices
[Magisk] KennethYoon91:
Updated Play Integrity Fix, along with Shamiko, works flawlessly,
[Magisk] prokiller1199:
Can anyone try Singpass app again?

Not working for me on Magisk alpha latest, app in denylist, shamiko, passed device integrity, latest lsposed.
[Magisk] prokiller1199:
@xcl1pse thanks, whats ur setup?
[Magisk] zgfg:
There were similar discussions in the Magisk General Thread. For that cases, it turned out that hiding Magisk app (it does not need to be repackaged/renamed/"hidden' from the Magisk app itself) worked out by using Hide My Apps:

- you need Zygisk LSPosed (Magisk module)

- then Hide My Apps (LSPosed module)

And then you need to configure in HMA - not easy and short to explain

And hiding by HMA really works also for other purposes like detaching YouTube from Playstore (bcs root Vanced YT requires specific old YT version that must never be updated) and similarly for detaching AndroidAuto (Google allows only navigation and various messages - and only through voice control; if you want to write mails or watch YT or Netflix on the car entertainment screen even when you park the car, you need particular old AA version, because only then custom apps for AA like CarTube, Fermata, Screen2Auto, AAMirror can work - otherwise AA block them).

And (only) HMA turned so far to be reliable option for A12, for properly detaching AA from PlayStore, for the purpose as above
[Magisk] HippoMan:
I am *extremely* happy that we finally have a separate thread for this!
[Magisk] pndwal:
Not sure if it's actually debug massages, but good analysis... You could say which bank / app you're using!...

Bank apps / devs requiring TEE are resorting to more and more clever tricks to detect / indicate a modified execution environment due to lack of confidence in SafetyNet API for obvious reasons.

It seems many are following Sparkasse banks S-PushTAN trick to detect even hidden / obfuscated Magisk app now as use of this app is universal w/ Magisk root.

Detecting applist should be prevented in theory since Android 11, but in practice some are still able to do this using some trickery, eg using Intent queries instead of API requests. Also, some like Sparkasse bank S-PushTAN can detect the hidden ('fully obfuscated") Magisk App by detecting the classes.dex code which does not change (unlike the package name) and can be used to identify the app. Their protection engine (Promon) seems to employ simple pattern matching on installed apps.

I was able to properly hide the already 'hidden' Magisk app (with Intent query hiding set) from S-PushTAN (and it would load) by using Hide My Applist LSPosed module. Hiding the unhidden app this way doesn't work (can app find package name etc even with HMA set?).

I have since discovered LSPosed HMA solution is no longer working for S. PushTAN since 3.5.2 on my MIUI device:

https://github.com/topjohnwu/Magisk/issues/1084#issuecomment-1013811582

Other MIUI users report report the same problem, but users of non MIUI

devices found PushTAN detects more apps but they could still subvert the detection simply by adding HMA app itself and other apps they used (GameGuardian etc) to HMA 'apps invisible' list for S. PushTAN. See issue thread above... PW
[Magisk] pndwal:
Incidentally, it would be very helpful to this effort if other MIUI users could try to bypass Sparkasse banks S-PushTAN app's detection and report. See post above. 👍 PW
[Magisk] crypticc:
great info thank you.

Thank you both and thanks for the additional info. I had gotten as far as downloading Shamiko and LSPosed. I even added Shamiko to give it a whirl but it seemed to behave similarly to what Magisk deny + USNF were doing - although maybe I missed something as GPlay and YASNC told me I lost authentication/CTS. Probably I just didn't clear data out of enough google apps.

LSPosed seemed like a whole new rabbit hole to go down so I'd skirted that but I will follow the breadcrumb trails you've set out for me.

Anyhow, for now I'm up and running and I now consider myself better informed so thanks again
[Magisk] zgfg:
If you were provoking me, ok I tested again. Did everything as maybe a month ago when S-PushTAN did not detect root on my phone

I installed S-PushTAN, and before opening:

- enabled DenyList and added S-PushTAN to DenyList

- disabled DenyList (because I use Shamiko)

- in HMA, under Select Effective Apps, opened S-PushTAN, enabled Hide, checked: BlackList, All hide methods and applied my template (list of apps that S-PushTAN must not see) where I list Magisk app and all my LSPosed modules.

I do not list LSPosed itself in the template because I use their 'parasitic' method (delete LSPosed app and create a shortcut instead)

Then I rebooted and opened S-PushTAN but this time it redirected me to the browser, complaining about unsecure phone/root

Still, it should be possible: to uninstall S-PushTAN, find on ApkMirror the older version of S-PushTAN (for whom hiding Magisk app by HMA worked), and configured everything for that older version of S-PushTAN

Then additionally to detach (=hide, again by HMA) S-PushTAN from Google Play, to prevent bothering about updates availability.

Hoping that the bank will not block that older version of S-PushTAN soon

I'm not going to push the envelope since I don't really need S-PushTAN
[Magisk] pndwal:
Please be assured that I make every effort not to provoke you. 😬

Same results here despite throwing whole kit and caboodle at HMA apps invisible list... Have a feeling PTAN now detects something in addition to apps... some isolated process leak unique to MIUI?

Yup, a downgrade may be best option for German MIUI users...

My purpose however is simply to determine what extra hiding may be needed for MIUI as opposed to other devices since others don't seem to have this difficulty... I suspect it is likely related to extra traces detected by MOMO for MIUI when it works... Momo is broken (crashes) for me w/ Zygisk & MOMO hidden ATM.

Thanks for confirming this method is not working for you either... I think you have Android 11; I have 10, so confirms it's not the different API level... Does MOMO work for you?...

Hope to see some fixes in updates to MOMO / Shamiko. Shamiko already hides isolated process w/ always unshare, but seems hasn't overcome MIUI anomalies yet. 😕 PW
[Magisk] vandyman:
I am doing the happy dance...

I hope this thread stays on track.

The other General Magisk discussion thread is a mess.. 🙃
[Magisk] pndwal:
Well it was produced since USNF to fulfill a completely different need, initially to hide Zygisk and Zygisk modules as these were not hideable initially (just as Riru / Riru modules were detectable until RiruHide was incorporated in Ritu), and later hiding for other indicators of Magisk root and Isolated process leaks (unshare) as well as support for whitelist hide list mode (as existed in deprecated vvb2060 Lite Magisk builds) have been added.

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-86306355

Official Zygisk-LSPosed is still not out, but CI builds have worked fine for some time. See artifacts in latest actions here:

https://github.com/LSPosed/LSPosed/actions

or go here:

https://t.me/LSPosedArchives

🙂 PW
[Magisk] zgfg:
Momo does not crash for me (yes, it is listed in DenyList).

And it works, actually 'better' than ever before - it detects everything as on the screenshot

-I still run the same Xiaomi.eu A11 (no more upgrades for my phone)

- same Momo 4.0.1 as before

- Newer Magisk Alpha (latest 24001), newer Shamiko (latest 73) and the latest by one LSPosed

And what was improved?

Actually, to the contrary - Momo now detects one more item "Found Magisk" that was not detected like two months or so ago

(For others:

Please don't start teaching me that I need this or that. I wasted a lot of time on Momo long ago and tried everything that you would advise me now

And I don't want to get involved now into discussions about the background: MIUI, odex vs deodex ROMs, etc

But I don't really care about Momo and its detections - I have already frozen the Momo back, let it sleeps for the long winter)
[Magisk] pndwal:
Yup, it was similar for me when I could see results. (Broke with 72 Shamiko)...

Suspect something in MIUI allows detection of Magisk / Unlocked bootloader as other devices evade these... Possibly Magisk one is the culprit if you're correct about it being newly found; I don't recall... PW
[Magisk] VD171:
Any magisk hider, please?

Edit: About how hiding root actually?

I've installed Magisk v24.1, LSPosed v1.7.2, Shamiko v0.4.3, XPrivacyLua v1.30 and everything is working perfectly.

I can hide root, xposed and zygisk, using it, please read my reply:

https://xdaforums.com/t/app-v1-10-vd-infos-package-com-vitaodoidao-vdinfos.4097379/post-86427499
[Magisk] zgfg:
Magisk General thread, Dec 6, post #49346:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-86055073

On the screenshot you can see that "Found Magisk" was not present

At that time I was running Alpha 23015 and some earlier versions of Shamiko and LSPosed. All the rest regarding Magisk, modules, LSPosed and its modules, root apps was the same
[Magisk] pndwal:
Yup; ... But seems I had both bootloader and Magisk detection then... thanks for reminder... perhaps nothing has changed w/ miui since Zygisk; just better PushTAN detection... Good to see the girls club working on improving Shamiko hiding though... PW
[Magisk] dohanin:
sorry, maybe i have missed, but how did you hide unlocked bootloader?

Momo and Key Attestation (both from vvb2060) detects it while other detections are successfully hidden.

A12+magisk canary zygisk+shamiko+usnf
[Magisk] pndwal:
That's what we've been discussing; seems USNF / Shamiko combination works as advertised for many devices (USNF hides enough to 'fix' SafetyNet, Shamiko hides more signs of unlocked bootloader, Magisk etc properly). Some seem to be able to achieve completely 'happy Momo' (MOMO detector says 'Environment is normal' / detects nothing suspicious) on some devices, eg RealMe.

With MIUI (Xiaomi) on the other hand, this seems difficult; we get a number of detections. I haven't been able to hide unlocked bootloader or Magisk from MOMO with Zygisk, although both Rootbeer Fresh and Rootbeer Sample detect nothing. PW
[Magisk] Eng.Raman:
The latest play store version of S-pushTAN 3.5.2 works well on my phone using Magisk Canary Beta 24.0 and HMA LSPosed module. :)(y)
[Magisk] pndwal:
Thanks! ... Guess you have public Beta if 24.0. (The debug logging enabled synchronised Canary version is 24001.)

Please remind me what phone you have; MIUI OS that appears to have issues with HMA method now while other devices / OSs can pass easily. Also, can you show us Momo screenshot? 👍 PW
[Magisk] Eng.Raman:
My phone details in my signature ( + installed LSPosed zygisk variant with 11 modules / 4 magisk modules: busybox, Enhance mode for HMA, Shamiko Mod, and Zygisk-LSPosed ).
[Magisk] Prof_Shekhar:
Thanks Xabu for your help.

But looking at all the issues of updating to Magisk 24.1 viz. installation of Zygisk & other associated application just to hide Magisk, I don't think I would be upgrading to Magisk 24.1 any sooner.

Regards
[Magisk] kramer04:
yes

you could read this

Samsung's "early zygote" prevents Zygisk from working · Issue #5299 · topjohnwu/Magisk

Zygisk is toggled to on but not triggered Device: Samsung Galaxy Note9 Android version:10 Magisk version name: canary Magisk version code: e8f31c7(24001)(23) magisk_log_2022-01-28T08:58:03.log

github.com
[Magisk] xabu:
All threads have their own specialism.

You should filter the threads and search them to find the answers for your own situation and own questions.

Don't think that you'll have the luck that someone gives you the straight answers, (which sometimes happens).

Have you shared your problem on the thread of the "Note 9" ....

Did you read this thread from page 1 ?

Most answers will not be meaningful for you, but there is a lot of meaningful stuff in the anwers.
[Magisk] xabu:
Don't wait too long. You're now in the first stage of the new life of Magisk and Zygisk. Following it from here (who doesn't want to see their child grow up) will be much easier than stepping in so much later after 100 pages.