yashsingh1/xdaforums huggingface dataset:
[Magisk] zgfg:
Delta, also without Shamiko on my side

For me, Momo detects only Magisk, not Zygisk or Zygote injected (better than with Shamiko - with Shamiko Zygisk was also detected)

Also, Native Test detects Injection only. With Shamiko, it was one more detection

Other detectors (Ruru, Oprek, SCheck, TBChecker) are fully green with only Play Integrity and no Shamiko
[Magisk] dipseeet:
:)

list of my modules installed in LSPosed :

eg. in App Settings Reborn:

i mean by

activated = apps are ticked

deactivated = apps are NOT ticked

+++

i have 2 questions about LSPosed and HMA

i tried to find sth about this but without success :(

i really like to know

what's "Xposed API call protection"?

and

what's the difference between them:
[Magisk] Catani:
To whomever might be interested... I fixed all my banking apps and Google wallet issues (root and zygisk being detected) by installing the lastest magisk alpha and the newly released shamiko alpha. Here's hoping that it last a couple of weeks/months. ✌️
[Magisk] Lord Sithek:
Starling still detects Zygisk though
[Magisk] Catani:
Did you install the latest Shamiko alpha?
[Magisk] Lord Sithek:
Yea, I wouldn't reply to you otherwise :sneaky:
[Magisk] CharlieMHz:
Still doesn't fix TnG sadly, but it seems to have stopped Momo from detecting Zygisk/Magisk, the only Momo detection left is Custom ROM. I'm on 7826d752-alpha (26301).
[Magisk] Catani:
Don't know what to tell you. I've been struggling with a lot of apps these last 10 days detecting zygisk/magisk and I tried every solution out there and none of them really worked for me properly. Until this morning with the latest release of shamiko alpha. Completely unistalled magisk and removed all modules. Installed from scratch with the latest release of magisk alpha and with the only module installed being shamiko alpha released this morning. Enabled Zygisk, configured DenyList and after reboot everything was working perfectly again. After a couple of test I reinstalled all my other zygisk modules and everything seems to be holding up. I own a Poco F3 Pro and on Xiaomi.EU stock ROM ..so that might also play into the ecuasion. I'm not on a custom ROM...I'm just rooted.
[Magisk] CharlieMHz:
If you don't mind, could you help to test if this app works for you? For most rooted users, it gets stuck on the splash screen.

Touch 'n Go eWallet - Apps on Google Play

Spend, Save, Earn, and Invest conveniently - all in one app!

play.google.com
[Magisk] Lord Sithek:
Out of curiosity, I've check that app on my three devices, one with Magisk Delta (26.1), second with Magisk Alpha latest (26.3) with latest test Shamiko and third with KernelSU and Zygisk on KSU installed. Results:

1) App opens fine with Delta and Zygisk enabled

2) App doesnt open with Magisk Alpha even with Shamiko

3) App opens fine of KSU even with Zygisk

So it obviously doesn't look for Zygisk, but it works with root solutions with unmount by default

EDIT: Naaah, even more: with Magisk Alpha it works, but without Shamiko! So Shamiko is leaking ;)
[Magisk] pndwal:
https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-86357533 PW
[Magisk] meric57:
Hello, can we flash patched magisk ap alone in odin to recover lost rooting.
[Magisk] pndwal:
NO - but if you just read Official Installation Instruction page (dedicated paragraphs for you Sammy users) you might learn many more essential tips! 😜 PW
[Magisk] J.Michael:
Not advised.

John Wu Installation Instructions caution against running Odin with just AP.

I think you should specify all four files in Odin.

I think if you use HOME_CSC, then you will not reset your data.
[Magisk] dohanin:
Anybody has issues with newer versions of Shamiko?

I'm still using Shamiko v0.1.2(47) because the other versions appears to be breaking something.

On my device that is having work profile, the blackberry apps can detect root with other versions of Shamiko, while v0.1.2 is working fine.

On my other device, both Magisk Detector and Momo all crash immediately after opening. Only Sahmiko v0.1.2 is ok.
[Magisk] Prof_Shekhar:
Request guidance please:

I had recently rooted my Samsung Galaxy Note 8 phone using TWRP and Magisk version 23 successfully.

All was running well until one day, when the Magisk decided to auto update itself to version 24.1. of course, this upgrade failed halfway leaving Magisk manager crippled with no option to either uninstall or reinstall Magisk.

Finally, I uninstalled the crippled Magisk app v24 1, reinstalled version 23 with almost 70% of functionality back (cleared security check) and able to hide most of the apps except banking app and of course, couldn't hide the Magisk app itself.

To overcome this problem, I uninstalled the Magisk 23.0 completely using the option in the Magisk manager.

Flashed the Magisk 24.1 from TWRP but still landed with the crippled Magisk manager 24.1.

Flashed the stock firmware from samsung, reinstalled TWRP and Magisk following usual procedure but the final result was still crippled Magisk manager. Bottom line, no root and no Magisk installation except Magisk manager installation.

Tried to install Magisk from the Magisk app but couldn't see the option for direct install except to go for patch.

Patched the boot image using ODIN3, booted into the system (using Android update manager), tried to install Magisk using the Magisk app 24.1 using direct installation method, but this time installation failed due to error "Unable to check signature, installation failed".

Thinking, this could be due to possible remanants of previous installs of magisk, uninstalled them using Adb commannd.

Tried to install Magisk 24.1 once again, but still getting the signature error as mentioned above.

Don't know where I am going wrong.

Will be grateful if some senior members can help me out of this nightmarish puzzle

Thanks
[Magisk] zgfg:
You get signature error when trying to install Magisk app - uninstall the old APP/Mngr and try again
[Magisk] Prof_Shekhar:
I believe I have uninstalled the previous possibly Magisk v 23 with the help of one run of the Adb command with success result.

Should I run few Adb command few more times to be sure?

Is there a way to check presence of any previous version of magisk on my system, so I can remove each one of them?
[Magisk] dohanin:
OK, the latest Shamiko (v0.4.2-97) fixed the crashing problem.
[Magisk] Spartacus500:
Can you share the link? I can't download from Telegram 😐
[Magisk] dohanin:
Releases · LSPosed/LSPosed.github.io

Contribute to LSPosed/LSPosed.github.io development by creating an account on GitHub.

github.com
[Magisk] Spartacus500:
Hmm 🤔 install Shamiko new &
[Magisk] amit_coolcampus:
Guidance needed:

I have a banking app called SC mobile. Which detects root even after adding into deny list + Shamiko module. It has a special service that runs whenever we open that app and it detects Magisk.

I could disable that service using another app called 3C all in one and when I unchecked that service, this app runs fine. Obviously keeping the shamiko and adding into deny list is still required.

What does this tool 3C all in one doing to detect that additional service that shamiko can't do.

For the test case, you could install that app from playstore and try opening that. You needn't to log in as it detects magisk on the very first page and gets closed if that additional magisk detection is not disabled.
[Magisk] ObsidianMaximus:
deleted
[Magisk] zgfg:
Actually, you don't need TG or Github - just use Update facility in Magisk app - see the post #340
[Magisk] amit_coolcampus:
Are you asking me?

If so then answer is No.
[Magisk] J.Michael:
"No", the statement "...won't work" is false?

Or, "No, it won't work"?
[Magisk] amit_coolcampus:
Just to clarify your confusion, I meant hiding root works fine with Universal safetynet fix + Magisk 24.1 Zygisk + Shamiko, but that one banking app which I mentioned in my app still detects the magisk.

To make it work I found a work around though, but just wanted to check if thats something can be added to shamiko or magisk as a change for the next version so that I don't need to use a separate app called ¨3c All in one tools¨.

Hope this answers all your questions. @J.Michael
[Magisk] Catani:
Seems to be working just fine. Try to completely uninstall magisk and install the latest alpha magisk and shamiko
[Magisk] zgfg:
Could you test Delta without Shamiko - thx
[Magisk] Lord Sithek:
I don't have Shamiko on Delta, so yeah, it works (even with Zygisk)

EDIT: If, of course it wouldn't complain somewhere further, but I don't have account to log in :sneaky: I've reached that far as on my screenshot
[Magisk] zgfg:
Yeah, thanks, as I expected - seems also to me that Shamiko is better not be used (and not needed) with Delta
[Magisk] Lord Sithek:
And from my little test it seems that it can be the cause of detections even in Alpha and probably official Magisk as well
[Magisk] CharlieMHz:
Thanks for the thorough testing!

Welp guess I'll have to give this a shot.

On your Delta device, do you have "Unmount modules by default" turned on?
[Magisk] Lord Sithek:
It's older (official) version so it's still called "SuList", but it does the same, so yea, I use that mode. But have you tried it on your device without Shamiko, just with Enforced Denylist?
[Magisk] CharlieMHz:
Have always used it actually, now that you reminded me. I got confused with all the different setups. This setup has always worked, just Delta SuList no modules required, except maybe USNF. But just a week ago, another bank app started detecting root so I had to find another setup.
[Magisk] simplydat:
You should try Shamiko alpha 0.7.3-183 from official telegram.

TNG works for me with it.
[Magisk] Lord Sithek:
In case you didn't read carefully: I DID use Shamiko Alpha. And TNG works for me with Enforce DenyList only. Anyway, I don't really use that app, I just did a test
[Magisk] Lord Sithek:
Interestingly, seems like some other Magisk modules trip Starling's security too. For example, I pinpointed Tasker Prvileged module by Rei Ryiuki (on KSU)
[Magisk] CharlieMHz:
I'm happy to report back that I've now gotten all my bank apps to work!

Long post ahead, warning...

And the culprit turned out to be... a Magisk module that I was using, it was a simple module that installs a camera app as system app (ANXCamera). 🤦‍♂️ I'm so embarrassed and disappointed that I didn't try disabling all Magisk modules before this.

Here's my minimal setup now:

Alpha Magisk - 7826d752-alpha (26301)

Hidden Magisk app

Uninstall root-related apps like HMA

Shamiko for alpha 0.7.3 (183)

Enforce DenyList OFF

Play Integrity Fix module 8.4 (only for McDonald's)

You can use HMA to hide root-related app if you don't wanna use Magisk's own hiding and uninstalling other root apps (e.g. HMA, Momo, other LSposed apps).

I'm surprised by how little is needed. Not even USNF/PI Fix, maybe cuz my banking apps don't check Play Integrity, as I'm now failing all 3 checks lol.

Here are the banking apps I've tested:

HLB Connect (Hong Leong Connect)

RHB Mobile Banking

SC Mobile

CIMB Clicks

TnG eWallet (Touch n Go eWallet)

Other apps:

Microsoft Teams, Outlook and Intune Company Portal, McDonald's app

The story:

I started off fresh as suggested by @Catani. Uninstalled Magisk completely via the Magisk app. Booted up and some apps worked, some didn't.

Installed Magisk through TWRP, booted up and most apps stopped working, as expected.

Installed Shamiko for Alpha, and most apps started to work

Tried hiding Magisk and uninstall HMA app. All apps are working now.

Installed my other modules, and TnG stopped working, uninstalled some and narrowed the cause down to ANXCamera module.

The fresh install may or may not have had an effect, I can't really tell conclusively. But it certainly helped me get to where I am now, by starting off with nothing and slowly adding fixes. Along the way here's some things I've noticed about those apps:

RHB and SC look for Magisk and HMA app. I tried running them and then installing HMA, one of the them immediately crashes and starts reporting root when I try to open it.

HLB needs Shamiko, and perhaps RHB and SC as well.

TnG doesn't need modules to work, just adding to DenyList is sufficient.

Microsoft apps seem to need Shamiko and look for root-related apps

Thanks to all who have been part of this discussion: @Catani @Lord Sithek @spicediablo @zgfg, etc. and I hope my post can help others with similar banking apps.

UPDATE 23/09/2023: McDonald's app required Play Integrity, so I installed PI Fix module for it to work. McDonald's app has nothing better to do than to detect root lol.
[Magisk] Randomginger:
My HSBC UK banking app stopped loading crashing Android system.

Narrowed it down to LSposed module update.

All working now.

APixel4 XL running latest LOS 20
[Magisk] J.Michael:
Between Story 2 and 3, did you try using Magisk with troublesome apps in Enforced Deny List, and maybe "rename Magisk app"?

Is HMA an app or a module? Is there an HMA manager app for the HMA module?
[Magisk] zgfg:
HMA is an LSPosed module, you can find the HMA thread on XDA, in the OP post #1 there is a link to instructions on GitHub
[Magisk] Smudgy63:
That's the problem I've been looking to fix, as I run lsposed for some customisation stuff and face unlock. Did you manage to get it work while lsposed active or still need to have it disabled?
[Magisk] CharlieMHz:
So just Magisk with Enforce DenyList ON and no modules? Nope, but I can give it a try now and report back.

Result: HLB and Microsoft apps stop working. Others still fine.
[Magisk] spicediablo:
I'm going to try your method soon! Have you tried company portal/teams? HLB stopped working?
[Magisk] RockerAlex:
Momo 4.4.1 detects everything because it is unable to be opened with HMA on - at least for me.

Banking apps work so probably not an issue but how is everybody else getting Momo to open and not detect anything with Shamiko USNF etc?
[Magisk] zgfg:
No, that's the known thing for Momo. But don't be bothered with Momo
[Magisk] RockerAlex:
Any apps successfully hiding USB debugging? Tried 2 now and a Magisk module all not working ...
[Magisk] zgfg:
Long ago I tried some LSPosed modules but they didn't work for me

Again, it's a question do you really have an app that complains because of USB debugging (disable and test) or it's all for the purposes of detectors like Momo (if so, then forget)
[Magisk] RockerAlex:
Yes banking and credit card app complains about it...
[Magisk] dipseeet:
should i ENable or DISable

'Xposed API call protection'

?

what is it good for

?
[Magisk] Randomginger:
Any configuration with LSposed enabled fails.

Everything also loads ok/passes with a config that would use deny list,.unless LSposed is enabled

USB debugging always enabled.
[Magisk] Smudgy63:
Yeah, I have no problem running rooted but as soon as lsposed is installed even without anything running through it, it won't open...using HMA and privacy space, managed to pass all app detection yet still won't open...now I'm confused
[Magisk] pndwal:
Enabled by default... it's for "security" so likely won't work with your configuration (security rules disabled)... 😬 PW
[Magisk] CharlieMHz:
No the "stopped working" is just a reply to J.Michael's request. My setup still works fine.
[Magisk] Wolfcity:
I've got success without LSposed or Shamiko. For my banking app (S-Push TAN) it was enough to hide magisk 26.3 (former builds didn't work) and use USNF by Displax.

I tried a lot of stuff before but for your information: My device is a Xiaomi mi 9t/Redmi k20 running Xiaomi.eu 12.5.3 (android 11).

It passes all checks (except "strong" naturally ).

Just an Info.
[Magisk] mGforCe:
In my case, lately lot of Indian Bank / Finance apps are just crashing.

--------------------------------------------------------------------------------------------------------------------------------------------------------

For reference my setup has been, for a long time as below:

Nothing OS Android 13, boot-loader unlocked & rooted

Magisk Delta Latest 26301, renamed Magisk Manager

Magisk Modules like:

USNF v2.4.0MOD_1.3

SafetyNet Sensitive props v3

Zygisk LSposed v1.9.1 (6990)

Shamiko v0.7.3 (174)

Under Magisk settings, have configured Unmount and all these bank apps are selected there.

Within LSposed I have following modules active:

AOSP Mods 2.4.1

BootloaderSpoofer 1.2

IAmNotADeveloper 1.1.0

Core Patch 4.2

Guide 1.1.2

HMA 3.2

Pixelify GPhotos

All bank apps are typically selected under BootloaderSpoofer 1.2 and IAmNotADeveloper 1.1.0

Also HMA template is used to hide all these Lsposed modules, Magisk renamed app etc from bank apps.

--------------------------------------------------------------------------------------------------------------------------------------------------------

No changes were done on my setup except updating to the latest version of Lsposed 2 weeks back.

Lately these bank apps started giving trouble after they were updated in Play Store. Back to back apps are giving issue...just crashing upon opening. For some of them, I get crash/app close message now and then, though they open otherwise.

Luckily a few of these apps like Kotak Bank, HDFC Bank etc, I had to remove these apps from Lsposed modules like Bootloaderer Spoofer, IAmNotADeveloper etc and they started workin/

For app like Bhim, which are simpler to hide root, is just crashing now. No matter what I tried, it is not working.

TB Checker says all OK. AppList Detector says all OK

Ruru v1.1.0 detects Libc File and Syscall File for HMA. Rest all OK.

Not sure what is happening... Any way to find out?

PS: I am able to use other Indian bank & finance apps like including SBI Yono :)

iMobile, Kotak, IDFC, HDFC, Paytm, Payzapp, PhonePe, HSBC, CitiBank, Axis

Edit: I also switched to Magisk Alpha. No success for IndusInd and BHIM
[Magisk] RockerAlex:
Zygisk is found on my set up with Magisk Alpha and Shamiko Alpha 183 by Momo - how does your set up differ?
[Magisk] mGforCe:
Dear Fellow India users

I was able to make iMobile (ICICI Bank app), Kotak Bank on my rooted phone with both Magisk Delta as well as Magisk Alpha. Tried on 2 different OS (A11 LOS and A13 NothingOS)

With latest update, the imobile app was detecting root. The root cause is Lsposed Zygisk.

To make it work, just remove imobile app from any of the LSposed modules (for me, it was selected in BootloaderSpoofer, IAMNotADeveloper, XPrivacyLua etc).

PS: Setup otherwise remained same as shared earlier here including app hidden in Magisk, usage of HMA to hide "root releted apps" from all bank apps etc.

IndusInd mobile app remains PITA. No solution still (including latest Alpha with Shamiko)

CC @shadowstep, xt7xda you asked for this in Magisk Delta thread, but relevant for all Zygisk / Lsposed users, so replying here

amn1987, just fyi
[Magisk] mar.aimn:
Hi, can you check if rhb bank app works with your setup? It's crashing frequently for me after try updating to Magisk 26.3. After reverting back to 26.1 TnG ewallet opening fine but not rhb crashing as I open the app.
[Magisk] CharlieMHz:
Yeap works fine, as I've noted it in the list of apps. I'm able to reach the login screen, but don't have an account to login with
[Magisk] RockerAlex:
Bro that makes no sense ... it's supposed to hide Zygisk no?
[Magisk] RockerAlex:
Thanks, I understand now :)
[Magisk] mar.aimn:
what is your setup? the shamiko setup? I tried but still crash but tngo smooth as feather
[Magisk] CharlieMHz:
It might be detecting some apps as suspicious. Try uninstalling those root related apps, or use HMA to hide them from RHB.
[Magisk] hammerhead123:
I'm on Magisk 26.1, can confirm that the RHB app works fine after using HMA to hide root related apps from it as suggested by CharlieMHz.
[Magisk] Yeedatoy:
Yes. It's an Xposed module and it's worked for a couple years with no issues. It's actually on the play store.

Hide USB Debugging Mode [Xpose - Apps on Google Play

An Xposed module that hides usb debugging status from apps.

play.google.com

Also on the play store is "dev opts hide." and there's a module called on GitHub called "im not a developer." These are all lsposed modules. Another is "bootloaderSpoofer."

In my experience I've only needed the deny list, play integrity bypass module, and one or two of the apps above even for the most impossible apps that think you're device is rooted when it's not. I've never understood all of these other mods like Shamiko, etc. They just end up overcomplicating something that is much more simple.
[Magisk] J.Michael:
Can you explain the reference to "apps that think your device is rooted when it's not"?

If you have Magisk installed, your device *is* rooted. Did you only install Magisk after being falsely accused of having a rooted device?
[Magisk] pndwal:
Some modules you mention are simply to hide opportunistic indicators of device compromise rather than root... Applist detection is another such opportunistic detection, and even Google agrees that use of indicators of other apps to prevent another app's code from running is an abuse... Seems that's why they don't object to Hide the Magisk app function, or listing other app, directory and setting obfuscation solutions on Play Store...

The concept behind Shamiko is pretty simple; John "sunsetted" MagiskHide root hiding, and encouraged 'Devs who are passionate about hiding' to "shine" by filling this void...

Shamiko and simpler modules like Denylist Unmount, are proper root-hiding solutions...

USNF and PIF are specific root hiding for GMS that also add needed device fallback to basic attestation and server end hardware backed evaluationType enforcement bypassing for SafetyNet and Play Integrity deviceIntegrity verdict spoofing (passing) that MagiskHide never added.

Nb. Denylist is MagiskHide repurposed as a tool for something quite different; it allows Devs and others to run root, but 'allows Magisk modifications to simply 'get out of the way' by reverting/preventing (denying) modifications'... It is NOT designed for root hiding.

Proper root hiding, like old MagiskHide, doesn't break ('deny') Magisk modifications or other modules (solutions) that inject into an app's zygote (processes). Further, while DenyList does hide root rudimentally by unmounting Magisk modifications including Zygisk, it won't 'manipulate expected signals', ie. it cannot alter (spoof) 'sensitive' prop values, nor does it automatically hide root from GMS processes as required for effective root hiding...

All these essential root hiding functions are now the domain of 3rd party solutions like Shamiko... It's only 'overcomplicated' in comparison to the somewhat simpler hiding requirements that existed when John/Magisk exited the root hiding scene...

🤠 PW
[Magisk] chaos193:
You're a lifesaver! Tried this on my Pixel 7 Pro and all my bank apps now load including the work apps installed on my work profile.

As for TnG, I used HMA to hide LSPosed modules/apps and TnG loads except for when AOSPMods is installed.

For some reason, TnG always managed to detect the module. Still figuring out the alternative.

Thanks.