yashsingh1/xdaforums huggingface dataset:
[Magisk] unknown_2:
u need HMA for both of those apps.
[Magisk] GolDeN_xXx:
Tried, none of that works
[Magisk] Nergal di Cuthah:
Hma seems to work for both of those according to the post between ours.

I bet you're missing something in setting it up (including hiding hma and lsposed themselves)
[Magisk] prokiller1199:
Any ways to bypass this screen for this app. Showing this screen.
[Magisk] wowkazmir:
I am unable to fork the repository, is there anyone that can help me get this fixed?
[Magisk] J.Michael:
You should be looking on Github.

Is there really nothing more you can say about how you are unable to fork?
[Magisk] wowkazmir:
So I understand it may be a bit of a stretch, but I've been trying to implement 32 bit support into the rootdir.cpp. The Pixel 7 has 32 bit support, but it needs to be triggered during boot. I've been able to inject the code but somehow I am not able to fork the official Magisk repository. Clicking the fork button literally does nothing.
[Magisk] hackwerk:
SOLVED: So happy, but because I read a small line in Momo root checker app 'do NOT inject blindly in all processes, but only give su to apps needed', I checked SuList for first time in my life (instead of HideList) and gave the few apps I need 'access' instead blocking 30 that check root, which makes sense, it WORKS. Perfect.

Edit: -Cut some of the unneccesary-

Some have an urgent problem with the Bybit (crypto exchange) app. The direct APK as well as the Google Play version are immediately crashing / shutting down on start, from a few versions ago.
[Magisk] prokiller1199:
No issue here on my Pixel running Android 14 rooted Dec patch.
[Magisk] mGforCe:
Exact same issue comes for an Indian app called TataNeu.

No known solution with Magisk Alpha, Magisk Delta etc

But the app works with KernelSU (I tried on A14, Derpfest ROM). So if you have KernelSU, try exploring.

Also on one TG group (PIF one from @chiteroman) I got a modified PIF module, wherein he claimed to have manaully patched some hex codes.. that module allowed to open this app. But I lost name of that person, so no longer have latest PIF module.
[Magisk] solar666:
Hi,

Allow me one question related to that info as you seem to be very much in detail on the different implementation methods.

Is there actually any difference or improvements today between between and comparing ZygiskNext vs. Zygisk of Magisk Alpha?

Was trying to find some recent comparison or comments but it is actually hard to understand what could be better in which condition.

Thanks in advance.
[Magisk] pndwal:
Official TJW Magisk Canary has now moved to native bridge loaded Zygisk, so it's now akin to Alpha (& Metagisk) Zygisk... Next stable will have it also...

ZygiskNext uses ptrace + fuse and appears to be better again for hiding Zygisk traces... Delta fork (if you don't care about It's experimental nature) has also moved to ptrace + fuse Zygisk (integrated)... You may still need to use ZygiskNext with KernelSU to successfully hide Zygisk from some apps like Starling Bank however.

👀 PW
[Magisk] hackwerk:
This NEXT bank app from Krungthai Bank (Thailand) is the last/only app giving me a hard time still, and detecting root at start and shuts down.

I use Magisk Delta (by HuskyDG)(with module PIF from chiteroman). See sig.

Since a short time I have a FAIL Device Integrity and also a FAIL CTS profile match.

A few weeks before this was all PASS.

Is that possible to fix this with my current config, or is Alpha really needed maybe?

Please help.
[Magisk] Nergal di Cuthah:
Upgrade pif to latest (released while i slept a number of hours ago)
[Magisk] hackwerk:
I already did (see sig) but the app and all the checks mentioned are not ok since a few versions (PIF) back, OR since I put it on SuList (access) enabled instead of the normal MagiskHide (blocked) list as I used to have.

Hope it's not that, because since SuList is on, finally my Bybit works (and does not detect root anymore).
[Magisk] Compass Linux:
Hi (and merry 🎄).

A Google Play Store update for a banking app I use (Banco do Brasil) has broken its usage (it force closes when I try to open it). As you can see in the screenshots below, 01.png is the old version (for which I have backup) and 02.png is the new version (which force closes). In Magisk I noticed they added (br.com.br.android_zygote) which didn't exist before.

Is the detection of Zygisk in Momo the likely cause of my issues? And are there ways to hide Zygisk from the app? If it's been explained already, a simple link to the fix will do.

What I'm using:

CarbonROM-9 A11;

Magisk 26.4;

PIF v14.5 (passing BASIC and DEVICE integrities);

BootloaderSpoofer v3.5 (locked Bootloader is applicable only for apps, not Android);

LSPosed v1.9.2;

Momo 4.4.1 (it doesn't appear in the BootloaderSpoofer list because it's in Magisk's Denylist).

Compass.
[Magisk] Nergal di Cuthah:
My first question is why are some processes under the banking app not enabled in deny list.

Since you're using lsposed why not hidemyapps with lsposed and hma hidden
[Magisk] Compass Linux:
There's no difference when I enable all the process under the banking app (it still crashes).

I'll investigate HMA. Thanks for the suggestion!

Compass.
[Magisk] xcl1pse:
Try using magisk canary. When someone asked me for that bank app in Play Integrity Fix thread, I didn't put that app in HMA tho. Also you can try to use shamiko to fix zygisk problem
[Magisk] Compass Linux:
Can Zygisk be hidden with HMA?

I'm trying but it's not working.

Compass.
[Magisk] xcl1pse:
no
[Magisk] en11gma:
when i use Magisk Manager v26.4 to patch my stock official AP file (7GB) or w/e i then use adb pull magisk-patched.tar file back to computer.

i have sometimes before just extracted the boot.img and vbmeta.img out of there and used those to flash with odin or heimdall.

my question is during the patching of the stock AP file i also see it does something to the ramdisk.

im just wondering when i only flash the boot.img and vbmeta.img am i not getting the complete working magisk by doing that?

im talking about the screen output when watching magisk manager patch the AP.tar file.

i also create look at the log file but that screen output tells me enough to know im not getting everything.

i know im not extracting a ramdisk.img file therefore im not flashing it either.

does this affect anything?

i know im not the only one doing it this way as ive seen alot of posts saying you dont need to flash the entire AP.tar and also i see some posts saying just put the stock boot.img and vbmeta.img in a tar file and let magisk manager patch that.

please explain. thanks
[Magisk] Compass Linux:
I'll check Shamiko then.

Compass.
[Magisk] pndwal:
As mentioned above, recommend moving to Canary Magisk for hiding now as native bridge loaded Zygisk is much better; ie. it's memory is 'anonymous' and can be much better hidden with Shamiko,... Same hooking framework loading method as Riru used once (inbuilt) Riruhide was introduced... Nb. This was just merged in official Magisk Canary (has been WIP since March per Metagisk fork, build in Alpha) but probably won't appear in 'public' Beta or Stable till 27.0...

Some apps may still require approaches still not (yet) accommodated by official Magisk however... See what I wrote just above:

https://xdaforums.com/t/discussion-magisk-the-age-of-zygisk.4393877/post-89228650

👀 PW
[Magisk] beeshyams:
Thanks for your explanation

Does one need to run Zygisk next with Canary too for better hiding? I don't have any troublesome apps and am on stable Magisk. It's just that it's good to kind of "future-proof", in case one of the apps implements stronger checks

Effetively Magisk Canary +Shamiko

Or

Magisk Canary +Shamiko+ Zygisk next

Which is better?
[Magisk] pndwal:
Many more apps work with new native bridge loaded Zygisk and Shamiko than previously, eg see this post and the post above:

https://xdaforums.com/t/discussion-magisk-the-age-of-zygisk.4393877/post-88468151

Some other apps may work better with ZygiskNext (or Delta fork which also uses ptrace+fuse, (don't know), but for some apps like Starling Bank, the only success stories (evidently because they use resetprop tool detection etc) is when ZygiskNext (ptrace+fuse) is used with KernelSU...

Nb. Shamiko 8.0.0_xx it's being beta tested in private channels ATM w/ these changes:

so this will likely fix some issues related to native bridge loaded Zygisk hiding still extant.

Aside: For users not desperate to use particular apps, I think a certain amount of future proofing will just arrive with Magisk (nb. new NB-Z will likely remain in beta for a while, even after 27.x Stable) and Zygisk updates (these are all largely from Canyie, Shana, vv and other LSP/Magisk Devs)... Also, we can't be properly future proof since there are effective (foolproof) ways to kill boot state detection bypasses available that banks simply need to wake up to and implement. (It's a fait accompli)...

🤠 PW
[Magisk] en11gma:
wow.

you can clearly see this isnt about magisk and just the modules

is there a good thread where people talk about "magisk"?
[Magisk] beeshyams:
Very informative as usual 👍

Bookmarked it. For now I will stay with the stable Magisk with Shamiko and HMA as next level in case any app turns out bothersome (to enable Shamiko to work, since it can't work with deny list, I am using HuskyDG's Magisk Hide)

Fully agree that one can't really future proof- case in point Citibank India started checking USB debugging enabled. I rolled back to earlier version, since I couldn't find any effective was to mask USB or BL unlocked if server side check is done). Interestingly, I read somewhere, may be on this thread that Citibank did the same elsewhere and they rolled it back and now they don't check. Same thing happened here with Citibank India!

I am on Pixel 6a and plan to keep it rooted with banking apps and Gpay (we don't have wallet here and Gpay works with device certified) as long as it's possible. At some stage keeping up with this game is going to be too taxing and maybe by next device will be unrooted.. Much as I hate it

Long post but again thanks a ton for the patient explanation. I always read your posts with respect
[Magisk] J.Michael:
ramdisk is not a partition.

Magisk patches the ramdisk in the boot image. Or Magisk creates a ramdisk in the boot image if the boot image does not have one to start with. When you flash the patched boot image, you *are* "flashing" the new ramdisk.

John Wu's original advice was to always have at least boot, recovery, and vbmeta in what you flashed as an AP file in Odin. As you say, lots of people get away with flashing less.
[Magisk] pndwal:
Not sure what you mean here...

Shamiko is simply a proper hidelist (hiding) module designed for official Magisk compatibility... DenyList* must be disabled as it's incompatible with hiding, but Zygisk uses list (only) from denylist for convenience... It's using list in hidelist mode however, like old MagiskHide...

If you're using stand-alone @huskydg MagiskHide module you may have misunderstood it's purpose; I think that's an alternative to Shamiko (for use w/o Zygisk), no?

*Nb. DenyList is simply a tool for developers/pen testers etc, and was never provided by John for hiding root; he envisaged the creation of modules for that, and knew that denying (& reverting) Magisk modifications would interfere with (break) some root solutions.

👍 PW
[Magisk] pndwal:
This and Magisk General Support / Discussion thread...

Nb. Zygisk is very much Magisk, it's a TJW developed component for enhancing module power/functionality*

Native bridge loaded Zygisk is a concept first developed by @canyie for @RikkaW's Riru, and has just recently been adopted in TJW Magisk... Even ZygiskNext is clearly ported from Magisk and modified (initially as Zygisk for KernelSU using native bridge loading, but now also as a alternative to inbuilt Zygisk for Magisk and also having recently moved to ptrace+fuse loading/injection)... It may potentially become a new official loading mechanism for Magisk's inbuilt Zygisk hooking framework also.

Further, resetprop is a Magisk supplied tool (applet of Magisk) and KernelSU was just mentioned in passing (as an alternative root solution that allows Starling Bank users etc to use their apps with root/Zygisk ATM), but you can clearly see that this is about Magisk, 'the Age of Zygisk' and the most important modules like Shamiko, the principal hiding module today...

*Nb. "Zygisk is Magisk in Zygote. This will run parts of Magisk in the zygote process to make Magisk modules even more powerful... Of course, root processes are still able to do various tricks to inject code into other process without supervision from Magisk. However, providing a responsible and easy to use API for modding is one of Magisk’s goal(s)."

🤠 PW
[Magisk] beeshyams:
Yes,

Yes, now it's clear thanks. I got it that the independent Magisk Hide is an alternative to Shamiko and that explains why the developer says "it is meaningless to use with Shamiko"
[Magisk] beeshyams:
@pndwal but the only contradictory need I can see is enabling Zygisk to run HMA and using HuskyDG Magisk Hide, in which case one may as well not use Magisk Hide and enforce denylist in Magisk and enable Zygisk
[Magisk] Compass Linux:
Thanks for the information. Very informative.

I've reverted to my backup version that works. Even though Momo results are better now (I think so; zygisk detection disappeared) the banking app continues to force close.

I'll wait for a future update of the banking app after disabling USB debugging (suggested below; fingers crossed). If that doesn't fix it, I'll likely follow your suggestion. Last thing I want to do is to switch custom ROM's hoping for a solution.

Compass.

How did you find out that disabling USB debugging helped? Trial and error?

I'm going to test it here. Who knows.

Compass.
[Magisk] Compass Linux:
Nope, disabling USB debugging didn't help.

Back to the previous verson of the app. Was worth trying.

Banco do Brasil: abrir conta (multiple complaints stating that the app isn't opening anymore after a recent update; since statistically speaking most of those users are on locked bootloaders and stock ROM, I point my 10 fingers at the bank's SNAFU). 🤬

I'm really lucky for having a Neo Backup of a previous version that is working (for now).

Compass.
[Magisk] beeshyams:
The citi bank app itself notified that USB debugging was enabled and it won't work on such devices
[Magisk] huskydg:
This method only support Android 8+, i don't think it will be in-built soon

Remap hide (copy memory to anonymous memory) not used by Zygisk. Zygisk itself is always unloaded after app specialize, not like riru, which will only self unload if all modules choose to not hook and unload, so remap hide is not necessary.

Also, anonymous memory hide can still be detected if it is not unloaded. Not unloading mean you will be detected.

Why using native bridge or ptrace over LD_PRELOAD, because LD_PRELOAD is very bad and the environment is hard to be repaired.
[Magisk] pndwal:
Ah yes (Watchdog logic w/ ptrace init using property wait to monitor zygote restart still needs API 26+, Android 8.0+)... Interesting that A8+ prerequisite isn't mentioned in ZygiskNext main page or release notes... 🤔

I see that you specify A8+ for Delta/Kitsune w/ ptrace init...

Interesting...

Just for my understanding, do you mean LD_PRELOAD memory was never detectable using /proc/maps string scanning anyway? (I had assumed it was.)... Please would you enlighten us on how it was detected and why native bridge or ptrace+fuse are better for hiding purposes? 👍 PW
[Magisk] sawdoctor:
There's an xposed mod to hide USB debugging and one to hide developer options. I have a tap to pay app for my business that I have to hide developer options from with xposed to make it work.
[Magisk] beeshyams:
Yes I am not a developer and dev opthide are the ones I am aware of but they didn't work. Unless you are talking of a different module?
[Magisk] sawdoctor:
GitHub - redlee90/Hide-USB-Debugging-Mode: A Xposed module that is used to hide usb debugging status. Useful for apps such as TWC TV which refuses to run when usb debugging is on

A Xposed module that is used to hide usb debugging status. Useful for apps such as TWC TV which refuses to run when usb debugging is on - redlee90/Hide-USB-Debugging-Mode

github.com

GitHub - xfqwdsj/IAmNotADeveloper

Contribute to xfqwdsj/IAmNotADeveloper development by creating an account on GitHub.

github.com

They're the 2 i use but can't guarantee they're getting to work. There's also an xposed mod to hide accessibility as some apps don't work with that enabled
[Magisk] nadeemakhtar1994:
I am using zydisk next module. Do i need to turn off inbuilt zydisk option of magisk or not?
[Magisk] zgfg:
Always check Readme(s) on the GitHub

Indeed, it says there:

"Standalone implementation of Zygisk,...replacement of Magisk's built-in Zygisk.
[Magisk] nadeemakhtar1994:
Sorry. Still don't understand. So I need to turn off inbuilt zydisk option from settings or not?
[Magisk] rodken:
Read this section under Magisk and let me know which portion is difficult to comprehend.
[Magisk] nadeemakhtar1994:
So read and disabled inbuilt zydisk. Now shows this for Pif and lsposed. Normal ?
[Magisk] xcl1pse:
Normal. Just test open LSposed or module using zygisk
[Magisk] J.Michael:
Are those all of your installed modules? Where's the Shamiko that provides the improved Zygisk?
[Magisk] nadeemakhtar1994:
Yes these are installed modules. I don't have shamiko because i use magisk delta which has enforce su list. I read somewhere that sulist better than shamiko. can someone confirm please
[Magisk] xcl1pse:
Nah, SUlist is opposite of denylist. The only reason kitsune latest can pass any app is that inbuilt ZygiskNext (even though not 100% implementation)
[Magisk] nadeemakhtar1994:
So you suggest to use shamiko and zydisknext together on kitsune?
[Magisk] xcl1pse:
Shamiko 1.0 can't use on kitsune latest. Your choice honestly
[Magisk] nadeemakhtar1994:
Neither I can install latest zydisknxt as it requires magisk 26404 bht kitsune on 26400
[Magisk] xcl1pse:
Theres canary version 26404 tho, but yeah slightly older than stable version
[Magisk] nadeemakhtar1994:
Reason can't use?
[Magisk] xcl1pse:
Magisk implementation in kitsune is different hence inbuilt zygisk only make abnormal behavior
[Magisk] zgfg:
Shamiko is actually for hiding Zygisk but usually it's not needed with Magisk Delta
[Magisk] zgfg:
C'mon, OMG

Zygisk that is built-in into the Delta/Kitsune, would cause abnormal working?!

Then, why would developer build in the Zygisk into his Delta?

He could simply remove it and distribute Delta without Zygisk

Btw, the same developer develops both Delta/Kitsune and Zygisk Next module

And FYI, just writing this now from the phone with Kitsune 26404, with Zygisk enabled (no Shamiko) and there are no abnormalities

---

And regarding some previous posts maybe here or in other threads

The problem with BusyBox module(s) is fixed in the latest Kitsune 26404, AdAway works fine, actually I have no problems

This is my second phone, hence I don't run here any critical app but about a dozen of 'root' checkers (TBChecker, Momo, etc) run the same or better here than on my daily driver with the official Magisk Canary 26404

Eg, Minotour shows Normal on Kitsune (yes, with the built-in Zygisk), what's practically impossible to obtain with the official Magisk
[Magisk] xcl1pse:
I state that using shamiko in kitsune isnt guarantee working properly like on TJW magisk, thats why I say only make abnormal behavior, Husky also said that in their tg chat. Husky implement this zygisk because ZygiskNext isnt change or modify any properties like zygisk on TJW magisk 24 - 26, so it more advanced on detection. Also why you can enjoy magiskhide with Zygisk without additional module while on older version cannot, but cant guarantee about maps hiding. BTW who say the same developer develops both Delta/Kitsune and Zygisk Next module? nullptr and 5ec1cff NEVER SUPPORT kitsune zygisk. Zygisk in kitsune already modified by Husky which is taken from ZygiskNext and never full implement ZygiskNext.
[Magisk] zgfg:
You wrote built-in Zygisk, not built-in Shamiko:

"...inbuilt zygisk only make abnormal behavior"

(or it was lapsus calami)

Shamiko is not Zygisk and Shamiko is not built-in either to the official Magisk or to Magisk Delta

I don't understand why ppl don't distinguish Zygisk and Shamiko

Zygisk provides the framework for modules, while Shamiko only helps to hide Zygisk (if/where it's necessary)

Eg, you need Zygisk for Zygisk-LSPosed or for PIF, irregardless of Shamiko or not

And Zygisk-Next is an alternative implementation of Zygisk (that better hides itself and doesn't need Shamiko)
[Magisk] xcl1pse:
Yes you can happy on your app not detecting root, but can you guarantee from other app and from another region? Theres people who rooted their main device while installing any app like banking etc. Thats why shamiko is developed. The corrected sentence for next kitsune release changelog is "Forget about shamiko, we modified zygisk so shamiko is not working normally" but Husky never state that in his magisk changelog and another people using TJW magisk and alpha using shamiko recommended shamiko to hide their root while other people not using TJW magisk or alpha

BTW Husky and reveny implement zygisk hiding method on latest kitsune since app complain about root while Husky dont wanna complain about shamiko
[Magisk] mkcs:
Any combination can beat the root detection of hk.com.hsbc.hsbchkmobilebanking?

Tried latest KernelSU+ZygiskNext+Shamiko still get caught
[Magisk] J.Michael:
I was trying to clarify what information was being provided by your screenshot.

The red message led me to believe that you do not have Zygisk enabled. I thought that your question was how to get something that requires Zygisk to work.

Maybe I got confused by several posts. I thought that I had just read about a new Shamiko that provided Zygisk. Maybe the other post said "Shamiki" and I assumed it was a misprint.

If you need Zygisk, and the only source of Zygisk is Magisk, then why do you not have Zygisk enabled?
[Magisk] nadeemakhtar1994:
Because i use zydisk next which requires inbuilt zydisk to be turned off
[Magisk] J.Michael:
Is ZygiskNext a Magisk module?

If you are using ZygiskNext, why isn't it listed in your modules list?
[Magisk] nadeemakhtar1994:
It was below the list
[Magisk] pndwal:
Yes, and modules can show disabled but are actually active when this Zygisk is active and inbuilt is disabled... PW
[Magisk] KennethYoon91:
Hello, Malaysian user here.

I am now facing some problem on Mi 9T Pro currently running Android 14 Evolution X rom, even with Magisk+ Shamiko module Magisk binary still being detected on Oprek Detector, and Momo detected Magisk and init.rc is modified, despite both app being added to denylist and blacklisted on HMA. strangely some of the ewallet app and banking app run without any problem with their app being added to magisk denylist and added to HMA some apps like MAE, MB2U, EPF. detected root and refuse to run, below is the screenshot of my current configuration, with the test results,

Are there anyway to hide the magisk from being detected by Momo and Oprek Detector? any help is much appreciated,
[Magisk] xcl1pse:
Your shamiko is in whitelist? why not updated it to latest with magisk canary? Also for init.rc problem, you may want to ask the maintainer. If I'm not wrong, maintainer of raphael is still Joey
[Magisk] KennethYoon91:
Thank's for the suggestion ,Updating to the latest Evolution X build & Magisk Canary V26.404 + Shamiko v1.0-290 does the job, coupled with LSPosed v1.9.2 7024 zygisk with HMA module sucessfully hides the Root. at least most of the apps require hide root works, except for a few minor that require init.rc issue fixed or else it wouldn't run or resulting account being banned.