yashsingh1/xdaforums huggingface dataset:
[Magisk] huskydg:
You can check with all list bankings i left in previous comment.

Video 1, zygisk+shamiko, imobile detect rooted

Video 2, magiskhide, imobile not detect rooted
[Magisk] shadowstep:
HMA is also needed for iMobile. As I said on TG, MagiskHide is still relevant, and it's great to have Magisk Delta (thanks for that!) as an alternative that has MagiskHide, but iMobile works with Zygisk + Shamiko + HMA. Some apps don't, but this one does. :)
[Magisk] svendsvin:
I updated to Magisk stable v. 25.1 about a week ago the recommended way. Everything went smooth. Then a couple of days ago my banking app detected root. Momo (4.3.1) tells me that the environment is broken, but I pass Safetynet (both), Applist Detector finds nothing, Rootbeer shows everything is ok and my phone shows as certified in Play Store settings.

I’m on MIUI 12.5.1 stock rom. Modules USNF 2.2.1 and Shamiko 0.4.4 (v. 0.50 crashes my banking app). I don’t use LSPosed. Magisk app is hidden.

The only change I made is updating HuskyDG’s module Magisk Bootloop Protector to v. 1.8. I removed the module, but still root is detected.

I have then returned to Magisk 24.3 with an OrangeFox Recovery backup. Everything is fine. My banking app does not detect root. Momo only finds Zygisk. I have tried several times to update to Magisk 25.1 again but every time my banking app detects root and Momo tells me the environment is broken.

Can someone tell what to do next, please? Why can’t I suddenly install Magisk 25.1 without my banking app detecting root?
[Magisk] huskydg:
Maybe refactoring magiskinit cause this, think you should stay at v24.3
[Magisk] m0han:
Just an FYI: I’m on crDroid v8.6 A12.1 rom. I have modules USNF 2.2.1, Shamiko v0.50, DenyList Unmount v0.2, LSPosed Zygisk v1.8.3 (6552). Magisk Delta app is hidden.

Momo v4.3.1 reports that the environment is abnormal (see screenshot -

init.rc is modified

is new for me; Magisk Detector has been saying 'unexpected' for long

), but I pass SafetyNet, Applist Detector reports 'All Clear', Rootbeer shows 'Not Rooted' and my phone shows as 'Certified' in Play Store settings. GPay worked when I last checked.
[Magisk] svendsvin:
Thanks. Don't really understand your answer so what causes this "refactoring" of magiskinit? Is it Magisk Bootloop Protector? What puzzles me is that Magisk 25.1 was working flawless for 3-4 days.
[Magisk] svendsvin:
OK. I don't rely that much on Momo but when my banking apps detect root I listen to her :)
[Magisk] zubies:
:( can u help me fix it
[Magisk] dohanin:
Hi, I don't use iMobile Pay, but I just tried this app on my phone (A12, Magisk Stable 25.1, USNF, Shamiko) and it detects root if I don't disable the Magisk App (even if it's repackaged to another name). But disabling the Magisk App, the iMobile App works fine. It's pretty much the same as HSBC App that has been discussed before.
[Magisk] silentuser143:
Hello Sir,

I tried this method and now my mobile boots into TWRP, not in system. PLEASE HELP

After uninstalling original magisk from magisk.apk, mobile rebooted automatically and goes in TWRP :(

Tagging @huskydg sir
[Magisk] shadowstep:
What hide methods do you have selected in HMA? You didn't cover that in your screen recording. Also, there's no need to repackage the Magisk app. HMA is being utilized to prevent iMobile from finding the Magisk app.
[Magisk] dr4go:
As usual so much information. Ah, you're using this phone and using those options. And you're trying to install that version of Magisk...

Sorry for being sarcastic, but if I'm already considering not to root my phone anymore, I really can't understand people rooting and modifying their phones without having any idea what they're doing.
[Magisk] zubies:
here it is. i did exactly
[Magisk] huskydg:
You only need to uninstall original Magisk App after switching to any custom Magisk (alpha, cygisk, delta,...) not Fully uninstall Magisk from the app (completely removing Magisk from boot image and system)
[Magisk] huskydg:
As he said you didn't use Hide Magisk app option.

In additional, if you try everything (Hide Magisk App, Hide my applist, zygisk+shamiko, ...) but it doesn't work, you can try to switch to magisk delta, turn off zygisk and use only MagiskHide or downgrade to Magisk v23 official to use MagiskHide which is still guaranteed to work for almost banking apps. If you are using magisk delta, you don't need to use Hide Magisk App option because delta already came with custom package name.

zygisk itself is the problem at hiding and leaves obvious traces.
[Magisk] jons99:
a new safetynet update has been released https://github.com/kdrag0n/safetynet-fix/releases

thanks to kdrag0n and osm0sis and benjibobs
[Magisk] pndwal:
FWIW

This may not be applicable here at all, but it's worth noting that for some apps, incl. Sparkasse PushTAN, neither one method is enough; Magisk's Hide the Magisk app as well as HMA hiding (using the three 'safe' methods, or just Intent queries) must be employed to successfully thwart their (Promon) protection engine.

This not only looks for known app names and signatures, but uses simple pattern matching on installed apps. Magisk's Hide the app will patch the package name in AndroidManifest.xml, repack it and sign it with a random signature for obfuscation, but the classes.dex with code remains and can be / is used to identify even the stub app.

Further, at least for S PushTAN, since a recent release mileage seems to vary per device... The above method was working across the board for some time, but it seems that no Xiaomi device users now have success (with latest releases) while OnePlus and other device users can still use this method...

The above distills the basics from this (very long) issue:

https://github.com/topjohnwu/Magisk/issues/1084

👀 PW
[Magisk] pndwal:
Some very interesting news re. apps that use the QUERY_ALL_PACKAGES permission (S PushTAN & many others) FINALLY being pulled into line by Google (from former XDA Editor in chief):

www.twitter.com/MishaalRahman/status/1511452117214679053

Reasons / excuses for the delay:

https://www.xda-developers.com/google-play-store-query-all-packages-rule/

What it means in practice:

My guess is that it will depend a lot on Google... Here's hoping... 🙃 PW
[Magisk] zubies:
no luck still
[Magisk] zgfg:
For the record:

Just switched from Momo 4.2.0 to 4.3.1 and Momo now additionally reports Found Zygisk - on both my two phones

I did not change Magisk (I was and I'm still on Canary 25101), I had and still have DenyList Unmount (not Shamiko) and Momo was/is enabled in DenyList (DenyList is not Enforced)

Moreover, on one of my phones Momo 3.2.1 now also additionally repots Found executable file "su " (I don't recall I have seen that ever before)

PS: Tried with Shamiko instead of DenyList Unmount, Momo 4.3.1 still detects Found Zygisk and on my Xiaomi 11 Lite 5G NE (A11) also Found executable "su"
[Magisk] J.Michael:
"Refactor" is a (relatively new, to me) word for "rearrange the pieces of a system". I think one Magisk release was advertised as being the result of restructuring the program -- no new features, no bjg fixes, just reorganizing the program itself.

You did not cause or choose to "refactor", except by choosing to update the version of Magisk. @huskydg's advice was "do not update Magisk right now, keep using the version that works for you".

If you really want to go down the rabbit hole of why 25.1 worked for says before having problems, you should go to github and try to engage a developer.

If, on the other hand, "worked flawlessly for 3-4 days" means "didn't get around to trying this one banking app for 3-4 days", then just let it go -- wait for another release of Magisk.
[Magisk] pndwal:
Just to add the detail, and for anyone interested in what is "a full paradigm shift on how Magisk hot-patch(s) the device at boot":

Refactoring magiskinit = magiskinit-rewrite... "A significant portion of magiskinit (the critical software that runs before your device boots up) is completely rewritten from scratch..."

https://topjohnwu.github.io/Magisk/releases/25000.html#magiskinit-rewrite

It involves changes in the way Magisk boots (initialises) in 2SI* devices, as well as broader changes in the way sepolicy# rules are patched/loaded (injected).

Notes:

* All devices on Android 10+ with the exception (excluding Pixel 3/3a series) of Legacy SAR devices launched with Android 9 (2018-2019).

# Access control policies for Security-Enhanced Linux.

Changes:

[MagiskInit] Update 2SI implementation, significantly increase device compatibility (e.g. Sony Xperia devices)

[MagiskInit] Introduce new sepolicy injection mechanism

See diffs (changes) here, especially in details.md (Internal Details doc):

https://github.com/topjohnwu/Magisk/commit/4f1a1879e572891bc005b489f82421303f602f72?diff=split

👀 PW
[Magisk] pndwal:
Further re. refactoring magiskinit (magiskinit-rewrite); It will break Direct Install to update Magisk in 2SI devices...

I put a lot about this in General Support/Discussion thread...

Basically, Direct install breaks due to previous Magisk injection method for 2SI devices (involving patching fstab) being incompatible with new Magisk...

Those facing issues (patching errors, bootloops etc) updating to 25.x (24303+) on 2SI devices need to do a fresh initial installation (patch/fastboot flash an original boot image) of Magisk again, thereby replacing the incompatible fstab-patched image...

It's a bit more complicated in configurations where disabling verity/verification to boot is still required (a number of custom kernels and possibly ROMs), which will need to be able to boot without Magisk prior to patching going forward...

Nb. Because verity/verification is no longer disabled 'in most scenarios', AVB (Android Verified Boot) will remain intact. This means a Red state verified boot issue (dm-verity corruption) is avoided which may actually have advantages for root-hiding...

https://source.android.com/security/verifiedboot/boot-flow

Of course, since an Orange state verified boot issue (UNLOCKED device) is reported, SafetyNet pass spoofing and, in many cases, other 'root' hiding will still be needed for apps requiring attestation to TEE...

👀 PW
[Magisk] J.Michael:
Could you say this again?

What configuration does not need to be able to boot without Magisk?

Do you mean that it is necessary to boot the unpatched system at least once before trying to install Magisk? Not much of a burden -- I thought most people use the system being patched to run Magisk Manager to patch.
[Magisk] pndwal:
No, configurations that couldn't before (relied on Magisk to strip AVB flags etc) will need to be able to boot without Magisk prior to patching going forward... Which is what I said. 😛

Yes, to confirm kernel will boot because it won't with Magisk either after magiskinit refactoring... But this is NOT for most people; only for those using "a number of custom kernels and possibly ROMs" needing verity/verification disabled!... That means custom kernels like Kirisakura...

And most people "facing issues (patching errors, bootloops etc) updating to 25.x (24303+) on 2SI devices" only "need to do a fresh initial installation (patch/fastboot flash an original boot image) of Magisk again, thereby replacing the incompatible fstab-patched image"... That image only breaks the Direct Install option...

I actually responded to your earlier post with more details on this at the end of this post (scroll down):

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-87068241

but I think you've missed it... 🙃 PW
[Magisk] silentuser143:
Thank you for the encouragement sir
[Magisk] svendsvin:
Thanks a lot for clarification and elaborating. Please correct me if I’m wrong, but I understand it as my Xiaomi Note 7 is a 2SI device and all I have to do is to patch boot.img instead of updating the recommended way and I have Magisk 25.1. Is that correct understood?
[Magisk] huskydg:
Xiaomi Redmi Note 7 is Legacy SAR
[Magisk] pndwal:
No, Legacy SAR as noted, and as such won't become 2SI even running Android 10+. 😛

You shouldn't have issues updating... Let us know if you do... PW
[Magisk] reforget:
Can someone help me check this app if it detects root (error 301 or 304) using Magisk Delta MagiskHide or zygisk+shamiko+HMA

BNI Mobile
[Magisk] pndwal:
zygisk+shamiko+25101... PW
[Magisk] reforget:
Thank you

Ah... Looks like the problem is in the custom rom or something else. I even tried work profile and multiple users but still no luck.

Maybe it's time to open a new bank account =D
[Magisk] vietmobi:
Do you know how to hide root for InstaPay Egypt, I have tried zygisk + shamiko + repack magisk + hide my applist but won't work

I am using magisk 25.1

The link is here https://play.google.com/store/apps/details?id=com.egyptianbanks.instapay
[Magisk] pndwal:
Sorry, couldn't hide root from this W/ my setup + HMA... Blank screens... PW
[Magisk] shoey63:
It detects Zygisk.

You need Magisk Hide, ie.Magisk Alpha/Delta
[Magisk] Godlydevils:
LoL this is quite funny.

Literally all financial apps are working, however momo+basic integrity+CTS is failing, but idc, cuz apps are working, really funny, probably devs ditched magisk hide, to adapt with zygisk and well, vulnerability exploited
[Magisk] svendsvin:
With the help of newly updated Shamiko 0.5.1 I can now update to Magisk 25.1 without Momo telling me the environment is broken. I only get the usual about unlocked bootloader and debugging mode is enabled. And Shamiko 0.5.1 is not crashing my banking app. So far so good. The only problem left is that my banking app detects root no matter what I try. I’m dependent on my banking app so my only choice has been to downgrade Magisk to 24.3 again and wait for some miracle to happen.
[Magisk] J.Michael:
Or, as @reforget noted, find another bank.
[Magisk] svendsvin:
Not a solution. Every bank in my country use this specific app to log in with :-(
[Magisk] 73sydney:
Fwiw

Delta is not entirely without its own issues, chiefly for me occaisonally losing root in the background, leaving me with having to reset my damn Watch 4 twice a day (if i was lucky) during the 3 days i tested it - once the link to watch is severed by root detection, theres NO way to recover it without reset....i soon went back to 25 debug and zero issues...luckily my bank app doesnt detect using zygisk/shamiko.

i.e. nothing is perfect and its still (relatively speaking) early days for zygisk/shamiko and im sure other zygisk alternatives
[Magisk] meric57:
Hello, hidden doctolib is hidden magisk docotolib detects rooting.
[Magisk] vietmobi:
Thank, i try magisk delta, turn off zygisk and use magiskhide. It finally works.
[Magisk] proza:
I have a moto G7 plus.

I installed the Pixel OS 12 Plus. I installed Magisk 25.1. I enabled both Zygisk and Enforce DenyList. In the DenyList, I only selected the Google Play Services, enabled all the items except com.google.android.gms.

I rebooted and installed module MagiskHidePropsConf-v6.1.2.zip. Rebooted and installed module safetynet-fix-Zygisk-v2.2.1.zip. Rebooted and use the terminal to change the props to Google Nexus 6P.

Rebooted, run Root Checker. It shows SafetyNet request Failed. CTS profile match N/A. Basic integrity N/A.

What else can I do to pass the safetynet?
[Magisk] huskydg:
Please use another checker such as YASNAC
[Magisk] proza:
It says "Something went wrong, Attestation response timeout"
[Magisk] zgfg:
Do you have GApos in your ROM?

SafetyNet goes through Google Play Services - if missing, it cannot work

AFAIK, there was a MicroG version (an open source alternative to GMS) but it must be provided with the ROM, proper version, etc

I don't know the details and frankly Im not interested (I use stock or custom ROMs with GApps), but I recall it was discussed here and/or in the USNF or MHPC threads, You could search

If you do have GApps, turn off all possible firewalls, blockers, etc - SN is not checked locally, GMS must connect to the Google servers
[Magisk] proza:
From the website, it says "PixelExperience is an AOSP based ROM, with Google apps included"

I have disabled the firewall and paused the adaway.
[Magisk] zgfg:
Here you have the official SafetyNet API specifcation:

SafetyNet Attestation API | App quality | Android Developers

The SafetyNet Attestation API provides services for determining whether a device running your app satisfies Android compatibility tests.

developer.android.com

You can see that no response or timeout means that somewhere in the request/response channel (call to GMS, call to Google servers, responses back) is broken.

It does not mean that CTS or Basic integrity fail (hence you cannot fix with USNF or MHPC), but there is no response (and therefore no verdict about - they might be perfectly passing if attestation channel was not broken)

If one SN checker fails to answer, it can be that that something is wrong with that checker (or they went over quota with the number of requests to Google today or so).

But if it happens to you with different SN checkers (YASNAC now works perfectly for me), the pipe is broken in your ROM or on your line

Eg, ask in the group where you took the ROM from, how they test and pass SN
[Magisk] rodken:
{Mod edit: Quoted post has been deleted}

You need to be more specific:

-- What device are you utilizing

-- Which version of Android

-- Custom ROM or Stock

-- What steps did you take [if any] to mitigate the issue
[Magisk] GreekPilot:
Good morning everybody. With new Shamiko v0.5.1 (117), no zygisk detected.
[Magisk] huskydg:
Seem meanless because it can't hide zygisk for some banking apps such as livin by madiri, instapay egypt, itsme,...
[Magisk] zgfg:
For me (Xiaomi 11 Lite 5g NE, A11) did not help, Momo stil detecting Magisk, Zygisk and su - same as reported previously:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-87084745
[Magisk] huskydg:
Did you checkbox all for momo processes in denylist?
[Magisk] zgfg:
Thanks, enabling all Momo proccesses for DenyList eliminated Momo detections of su and Zygisk
[Magisk] aximili:
I can't get HMA to work. I have enabled it in LSPosed but I don't have the module in Magisk.

(I have tried installing it from the APK and from the Play Store)

Help please?
[Magisk] m0han:
This is how I have Momo configured in DenyList at the moment. The middle item was disabled after reading somewhere that it is advisable. (I don't recall where I read it.) Would my Momo situation change for the better if I enable that also?
[Magisk] dohanin:
Probably the same.

If you like to hide Init.rc, you can install another magisk module InitRcHider. Or use Shamiko which has included initrc hider since 0.4.3. Although it doesn't make much difference I guess as not many apps would try to look for it.
[Magisk] m0han:
I have used 'InitRcHider'. I'm using the latest Shamiko. https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-87084405
[Magisk] dohanin:
Oh sorry, didn't read your earlier post. So you're using Delta. I have no idea then.
[Magisk] williamcll:
Anyone know what I need to get around Hang Seng bank's detection? Safteycheck is all good, but putting the app in denylist as well as closing almost all services in servicely doesn't work. Installing shamiko and turning off denylist doens't work either.

Edit: Island work
[Magisk] dohanin:
Try disabling the Magisk app.
[Magisk] williamcll:
that's a bit too far fetched, I also asked on the XDA discord and they told me to use Island, which worked.
[Magisk] dohanin:
Well, using a work profile is more than just freezing the Magisk app, isn't it? Anyway, some people who need to reserve work profile for company use (like my case), cannot use island. And to clarify, I was suggesting to disable (i.e. freeze) the Magisk app, not Magisk itself.
[Magisk] pndwal:
Not clear if you used/tried Hide the Magisk app in App settings...

Also, using HMA LSPosed module to further hide already hidden Magisk App also works for many bank apps... PW
[Magisk] huskydg:
If you compile a custom magisk with different custom package name by yourself, you will not have to freeze magisk app
[Magisk] huskydg:
Zygisk is just for hiding root???? Since i just see you guys discuss about hiding root in zygisk thread
[Magisk] dohanin:
I guess he did. I did as well, but hiding Magisk app with a random package name appears not enough for some banking apps. For some reasons, they can still identify Magisk app unless it's disabled (or hidden by other methods like HMA) - well, I never understand this part. Are all apps allowed to look through other apps in the device, but not for apps that are disabled?
[Magisk] pndwal:
Hope so too... Not clear though...

See this:

https://xdaforums.com/t/discussion-magisk-the-age-of-zygisk.4393877/post-87078475

and this:

https://xdaforums.com/t/discussion-magisk-the-age-of-zygisk.4393877/post-87078529

👀 PW
[Magisk] dohanin:
Thank you. But I found no explanation of why disabled app can avoid detection. There are some apps that can show a lot of information of installed apps (enabled or not), e.g. https://play.google.com/store/apps/details?id=com.majeur.applicationsinfo ,without requesting any permissions.

But why some banking apps only check enabled apps? Sorry if I missed some key points in your links.
[Magisk] pndwal:
Still, you said

... the need for further hiding is explained; I went to some trouble to distil the info from that GitHub issue re. pattern matching etc...

Good share, thanks...

This was possible in A10 but was supposed to be fixed in A11 in May 2021.

App Devs discovered an easy bypass however, using the QUERY_ALL_PACKAGES permission, and have since exploited this loophole (and others).

Google has been slow to patch /enforce their rules... Enforcement for compliance was pushed back to Nov ('for Covid-related reasons'), and it seems still not enforced till recently, but a new ultimatum gave June 1 2022 as the date apps would begin to be pulled for non-essential use of this permission or failure to issue a proper statement re. why use is 'essential'...

This is all in the link(s)...

I think they do whatever they can... Fraud / scams / hacking / device security are becoming critical issues... With IOS ahead of the game and Google's SafetyNet API an abysmal failure*, banks are becoming as inventive as possible and Google compliance rules are also viewed as fair game / expendable...

* Read 'Totally unreliable', at least while fallback from Hardware to Basic evaluation for attestation to TEE is possible; this effectively bypasses / makes a joke of (A)ndroid (V)erified (B)oot and it's 'Chain of Trust' ...

You did, but hopefully the summary will clarify a few things for all... PW
[Magisk] williamcll:
Turning off magisk might break my other apps.

Zygisk was on as well as LSPosed and Shamiko was turned on the whole time and it didn't work.
[Magisk] zgfg:
Please distinguish Magisk from Magisk app = former Magisk Manager

You even uninstall Magisk APPLICATION but Magisk, all its modules, root Grants, DenyList continue working as you previously configured.

Any time you install Magisk APK back. you continue using it

App is only user interface to make you managing the Magiske more easier - otherwise, you would need to use Magisk CLI )command line interface)
[Magisk] dohanin:
As said, I meant disabling (freezing) the magisk app, not Magisk itself. The app is only needed when you grant superuser access, adding apps to denylist, managing modules and other settings.

There are a number of apps which could automate the freezing. E.g. Airfrozen, Ice Box.
[Magisk] pndwal:
It won't... Even uninstalling Magisk App does not disable (or 'turn off') Magisk...

Some actually resort to uninstalling it during bank app use / when not needed... Works well enough for them...

Still not clear if you used/tried Hide the Magisk app in App settings, or used HMA LSPosed module to further hide the already hidden Magisk App... PW
[Magisk] m0han:
Fox's Magisk Module Manager updated to 0.5.3

Releases · Fox2Code/FoxMagiskModuleManager

A module manager for Magisk because the official app dropped support for it - Fox2Code/FoxMagiskModuleManager

github.com
[Magisk] doniedogawa:
I just installed Magisk v25.1 on my LG V20 H990DS with stock oreo and success without having kernel issues, but the app itself can't be opened (stuck on logo).