yashsingh1/xdaforums huggingface dataset:
[Magisk] joegreat:
Thank you - "unhide" did the trick - now I could install the update to version 26.0. (y)
[Magisk] pndwal:
Can use this method:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-88369459

🤠 PW
[Magisk] pxrave:
Hey guys new apps can detect root again. I used latest stable and upgraded to v26 beta but seem like @topjohnwu not fixed the new detection in v26.

The apps use /proc folder to detect magisk is there any way to fix this in 26.1?

Best regards
[Magisk] zgfg:
TJW does not 'care' about detections and he will not 'fix' them

You need to use DenyList, USNF latest fork (or SN Sensitive props), Shamiko (or MagiskHide module), probably HMA, etc (I use also App data isolation module) - details depend on the particular 'banking' app and what it looks for

Details are spread in this and other related threads (similar questions/answers, comments and guides)

Some facts since like two years ago (communicated here and elsewhere):

- TJW is employed for Google

- he does not answer on XDA (per his XDA profile, he posted last time on Oct 1, 2020), you can twit him instead (link is in the Magisk app)

- you can report issues to GitHub but it instructs that 'issues' about detections will be force-closed🤔
[Magisk] pndwal:
As mentioned, root hiding is now the province of 3rd party modules; DenyList is not designed for proper root hiding. (It's a tool for development really.)

Latest Shamiko improves Zygisk hiding and hiding for other root traces:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-88384687 👀 PW
[Magisk] exis_tenz:
Question: I see the new V26 is out, but my Magisk 25.2 stable doesn't see an update. Is this because V26 is still beta or canary? Should I just lay back and wait for V26 stable to come out and then Magisk will update itself via the app?

I can't find anything about this. Magisk offers a Shamiko update, but it won't install on versions <V26.

I don't mind waiting several days, even weeks, but just wanted to ask how things are ment to be.
[Magisk] zgfg:
If you open Settings, Update channel, you can switch to Beta or Canary - they are aligned now, Beta will offer you update to v26 and Canary to v26001

Or wait for TJW to update Stable also to v26
[Magisk] exis_tenz:
Thank you! So on that case I'll wait till stable arrives. I just wasn't sure how to V26 was to be interpreted. Now I know it's not the stable version. Thanks!
[Magisk] J.Michael:
How do you know "The apps use /proc folder to detect magisk"?
[Magisk] hengkidermawan:
thanks, bro its work
[Magisk] pndwal:
Yes, this is the issue with current Zygisk implementation... Zygisk can be detected in /proc... It's how Riru began to be detected (pre Riru 22.0+/RiruHide)...

Looks like this may finally be overcome even as soon as next public Magisk release however. (26.1?)... Or maybe in a 2600x build. 😶 ... See:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-88392643

😋 PW
[Magisk] 90dsend:
Hi, sorry for a noob question. Where do I download this Native Test app? Searching in the thread did not produce any info on it. Thanks!
[Magisk] martyfender:
I downloaded it from Magisk Alpha Telegram channel. In its current version it is called NeoNativeDetector. I know that other versions were downloaded somewhere on Telegram.
[Magisk] zgfg:
I see a pretty old one on TG channel and on GitHub (I think that was the one the old posts here were referring to):

GitHub - LSPosed/NativeDetector: Detect Zygote native injection like Riru and Zygisk

Detect Zygote native injection like Riru and Zygisk - LSPosed/NativeDetector

github.com

Could you attach (?) your newer version maybe - thanks
[Magisk] m0han:
Found on TG around 16-Feb-2023
[Magisk] zgfg:
Thanks for sharing

This is really a verbose detector (or am I missing something?) - screenshots attached😁
[Magisk] BillGoss:
l just received Magisk 26.1 stable. Updated the app, did a direct install to update boot and all is good.
[Magisk] pndwal:
It's

so dev is:

Nullptr Dr-TSNG

Verbose detector:

NativeDetector​

- Some Android environment detection examples

Off course dev for:

Hide-My-Applist​

- An Xposed module to intercept applist detections,

ApplistDetector​

- A library to detect suspicious apps like Magisk

etc.

Nb. She also has

ZygiskOnKernelSU​

- Run Zygisk on KernelSU

and more... PW
[Magisk] zgfg:
Perfect. And today is raining (on my side), that's also some kind of info - but not what I was asking

Do you see anything else from this New detector, besides the rotating Found Injection verdict?

Without putting it even to DenyList - Found Injection. Put to DenyList but with disabled Shamiko - still and the same Found Injection, etc

No gradation. No clue did you do any step to hide root or not. If nothing else to have: 43 Found Injections, then 21 Found Injections, 7 Found Injections...

I doubt how can one use it to help him debugging why some banking app detects root

Hence once again, do you obtain anything else from that app, besides the spinning Found Injection? I'm curious, would it say differently on the stock ROM with locked BL (then it would really be a perfect joke app)😁
[Magisk] m0han:
I guess @zgfg commented about the 'verbose' result displayed :D. Funnily, this is the same with/without adding the app to MagiskHide (Delta) and Template / Effective Apps (HMA) :rolleyes:.
[Magisk] zgfg:
Thanks. That's what I was asking/commenting. I tried by clicking on "Found Injection" or so to squeeze more info, but nothing.

Now I feel better if I'm not alone
[Magisk] gsmdb:
My case S20 android 13

- with magisk 25.2 deleted magisk app the magisk daemon works flawlessly in background without the need to install magisk app

- with magisk 26.1 deleted magisk app then the magisk daemon does pop up frequently without invoke of any root apps demanding root privilege as I can compare with version 25.2. It does install magisk app (placeholder) by itself

The new behavior of 26.1 is it standard in this build? Annoying compared with build 25.2! Does anyone experience the same issue and how to get rid of it? Thanks for help.
[Magisk] pndwal:
So sorry about the Croatian weather... Glorious here mate... (Well, not really.)

Actually I hadn't intended to comment on that; Was responding to this:

but pinged you with wrong post link. (Fixed now thanks)...

Seems no-one linked original source, and your old link was to differently signed Native Detector from Shana... Actually her later one was offered as Zygisk Detector; you linked old Riru detector:

... Very verbose also...

Thought you might appreciate the source...

Anyway, checked my other device with old Zygisk:

... After updating to latest Zygisk this becomes just "Found Injection"

Next, disabled Zygisk and, predictably, this changes to just "Found Magisk"... Clearly the Zygisk Injection was being detected, but with that disabled I have Magisk detection since Shamiko is no longer hiding Magisk/root...

*** I'm guessing (hoping to see) this result should change once we get proper Native Bridge based Zygisk loading in TJW Magisk... 😛

This is still a WIP however (wasn't merged yet) with fixes still being made by Shana and apparently much proper testing still needed... See current To Do list:

Of course it'd be different w/ locked B/L assuming you mean w/o Magisk... There'd be no root-enabled injection into zygote to detect. 🤪

Anyway, Zygisk Injection hiding is no joke...

We just can't hide Zygisk memory from /proc/maps string scanning by Magisk obfuscation, Applist concealment (😜) or even with hiding modules like Shamiko with the current loading method... Native Bridge loading makes the memory of Zygisk and modules "anonymous memory", hidable from string scanning per Haruue Icymoon's RiruHide concept...

🙃 PW
[Magisk] zgfg:
Interesting. But despite all my efforts in one direction:

- using all hiding tricks, incl. even HMA and disabling Systemless Hosts, BusyBox, V4A and ReVanced

and the other direction:

- not just not putting the New Detector to DenyList but even disabling Shamiko and so

it always reports me the same and only: Found injection (spinning)

Never reporting Found Magisk or Found Zygisk, or anything more or less (with rebooting and wiping Data for the detector between the tests)

With various others detectors (TB-Checker, Momo, Ruru, Memory detector, etc), the detections are increasing or decreasing depending on how I configure the spoofs. But not with this one

Btw, I had the same results on both my phones with Magisk v26001 vs Delta 25210 (different hiding settings), hence this detector is really of no practical use/help for me (despite who developed the app - I know they are the like small goodnesses for you😁)

---

Also, I will no more answer on the debate about the deprecated 'Manager' name

I wrote what I wanted and I don't see anything new either in your newer comments👍

---

Maybe it's due to the bad weather here (you also commented in another thread and post this morning)

---

I rather spent this afternoon by further researching/testing how on my (daily driver phone), when connected to the WLAN whose DHCP pushes DNS server settings to Google's 8.8 8.8 (8.8.4.4), Chrome suddenly stops obeying local hosts file redirections (ad sites blocked by redirections to 0.0.0.0 or 127.0.0.1)

And how I could circumvent by forcing Static parameters in the WLAN connections, thus forcing the ISP DNS servers instead of the Google's DNS servers pushed by DHCP - then Chrome again correctly follows the 0.0.0.0 redirections in the local hosts file

As I commented (by editing) my yesterday's posts/finding in the AdAway thread

That's something that was bothering me for some time, since I observed that when connected to the WLAN in one particular shop, my phone (Chrome) immediately stops blocking the ads - on the same news portals where the ads are otherwise always correctly blocked by AdAway+Systemless hosts, no matter if I use WLAN at home, work, other public WLAN connections or Mobile Data

Finally I got it - nothing wrong on the AdAway or Magisk/Systemless hosts but a strange case that for Chrome, Google DNS server (if pushed by DHCP) take precedence over the local hosts file - I also asked earlier about managing that precedence on Android (on Linux it's possible) in one of the threads here
[Magisk] pndwal:
So did you disable Zygisk, reboot and re-test? The change should indicate Zygisk injection was being detected as I said...

🤔... You asked someone for latest version... I gave original source... I just now expanded on

cos you pressed:

I don't know what you mean here... Perhaps you could clarify?

🤔 (Is any of this relevant?)... 🤠 PW
[Magisk] J.Michael:
@zgfg Do you get different ordering of (local hosts file, remote DNS) if you use a different browser?
[Magisk] J.Michael:
You seem to be describing Magisk insisting on installing a (stub) manager app if it does not detect an installed manager app. There were mentions of this when it started happening. I am confused because I thought it was much longer ago than v25.2.
[Magisk] zgfg:
Frankly I did not test. I stick with one browser, Chrome for historical reasons (started using in 2017 or so, and synchronizing my favorites from one device to another), since of the built-in translation (and - not sure why more)

I could test but I see that many browsers integrate some VPN, ad-blocking, etc. Hence I'd need to know which one to test but in the 'raw' mode

Also, I tested with few more apps for whom I well know how/where to expect ads and they don't show - ie, they continue to follow blocking redirections from the hosts file no matter how the DNS server is configured by DHCP
[Magisk] Rockpanchal28:
How to fix all this , due this pubg new state is crashing and also tell your telegram channel
[Magisk] Rockpanchal28:
Send me invite link bro for tg channel
[Magisk] zgfg:
For what?

I'm more in Alpha TG channel and don't have the link
[Magisk] Rockpanchal28:
What's your channel name? And reason I want to join is I am facing issues in momo application
[Magisk] zgfg:
I'm just a user like you

Bye
[Magisk] m0han:
AFAIK, no one really cares about and/or offers proper support for M0M0 app's findings - here or on TG.
[Magisk] Retenor:
Sorry if this is the wrong thread to ask this: What process do I have to follow if the Integrity checker fails me on all tests, also safetynet does not pass anymore for me.

Device: Xperia 5 III

Newest Magisk version

Modules: nostoragerestrict, shamiko, systemless hosts, usnf mod by displax, zygisk lsposed, zygisk sui.

enforce denylist is not checked, zygisk enabled.

shamiko running in whitelist mode.

denylist includes play services.

lsposed modules: play integrity bypass, minminguard, location indicator whitelist and hide mock location.
[Magisk] Retenor:
Quick update... relying on zygisk, enforce denylist and safetynetfix only does get me back to passing safetynet attestation, but only ticks Basic_integrity and Device_integrity. I'm assuming it is not possible passing strong_integrity at this time with an unlocked bootloader and rooted stock rom?
[Magisk] zgfg:
For the beginning, I would not mix one and another, USNF and that LSPosed module, supposidely for the same things. Who knows how they interfere and does any of them work at the end

So, install the latest Displax USNF fork and disable all other except Shaniko (ok, Systemless hosts should not interfere)

Remove Play Services from DenyList - actually, if USNF worked properly, it already had to remove it

Reboot and make sure that Magisk shows that Zygisk is properly enabled and that Shaniko is not complaining about Zygisk

You must not run SE Linux in the Submissive mode - you will never pass PI with. Therefore, disable or uninstall the rest and test as simple config as possible (LSPosed by itself is not a problem but inspect if its modules cause the problems)

Btw, from PI, you can only pass Basic and Device Integrity, not Strong
[Magisk] zgfg:
Just answered you that in the previous post
[Magisk] Retenor:
Thank you. Is there a way to get google wallet to work without strong integrity? That app currently failing was my initial reason to branch out to other modules.
[Magisk] casouzaj:
For me Google Wallet works. Sony Xperia XZ2 phone, running LineageOS 20.0. Latest Magisk Delta Canary here. Zygisk, MagiskHide and SuList are enabled. USNF-2.4.0_MOD_1.2. Both basic and device integrity tests pass.
[Magisk] m0han:
Many here have GPay / Wallet apps working without strong integrity. As for me, I'm on the latest Magisk Delta Canary - with Riru; not Zygisk.
[Magisk] pndwal:
Once PI deviceIntegrity is passing you may need to clear data for GPay/Wallet (assuming this is also in denylist) and set up cards etc again to get it working immediately...

The cached fail results will often clear without doing this but some report "Device does not meet security requirements" message in Pay contactless setup menu can remain for up to a week if data isn't cleared...

👀 PW
[Magisk] chrbur:
Hello. I intalled Magiks Canary 26101 on my Pixel 7 Pro.

I also installed these Modules: MagislHide Props 6.1.2-v137 ++ Shamiko 0.7 (161) (is working) ++ Systemless Hosts 1.0 ++ USNF 2.4.0-MOD_1.2

Everything works fine. Banking Apps, Wallet, some "special" Apps whicht detect root works by using Zygisk + Magisk Hide + Shamiko / do not force Deny List.

Rootbeer & SafetyNet tell me thas everything is (or should be) fine :-)

BUT only the **** VW We Connect App still detects Root. I don't know what I can still do?

Special effect :)

Version 5.15.0 or older Versions detect root!!!

Version 5.15.1 doesn't detect root!!! - I use this version without automatically updates.

Versions >=5.15.2 also detect root!!!

I don't understand that older versions and newer versions detect root and only 5.15.1 doesn't.

Has somebody a good idea how to bypass root?

The App ApplistDetector tells me that there is a Problem with Secure Settings App and Settings (hidden Magisk App)? Maybe We Connect detects both Apps as Root?
[Magisk] zgfg:
To hide apps from Applist Detector, use HMA (Hide My Apps, module for Zygisk-LSPosed)

You can try then could it hide also for Falsch Wagon😁
[Magisk] ffp.:
Hello. Suddenly, my Santander bank app began detecting root. Im using latest magisk (26.1) with zygisk and shamiko. Bank app is in deny list and magisk is hidden with abother name. Renamed Twrp folder. I dont know what else to try...
[Magisk] chrbur:
Oh it wooorks :-D GREAT!!! We Connect doesn't detect root anymore. It was difficult for me to configure LSPosed and first I did not know what I have to do but Dr. youtube helped. So I can use the last version of We Connect. THX!!!
[Magisk] chrbur:
@ffp. It sounds like the same problem I had. Did you install Zygisk LS Posed? I think Santander also detects several Apps which are a notice for root?
[Magisk] gallegonovato:
Good afternoon:

I don't know if this is the right place to ask this doubt. But I didn't know where to ask it.

After upgrading Magisk to version 26.1 from the previous stable version. From inside Magisk I always do the updates from the stable channel.

I look at the main screen of Magisk and I see that where it says App. In last it says not available. And it does not come out install as the previous version. When in the previous version if it came out. I have tested in the beta and stable channel. And still the same.

I attach a screenshot: https://ibb.co/kh4s3yg

I do not know if everything is correct or something went wrong in the installation. But I think that if I remove and reinstall Magisk the root of the device is screwed.

I use lineageos.

Thanks for your time and help.

Pd: and a question, what is the stub-release.apk for?
[Magisk] ffp.:
You mean zygisk lsposed module in magisk? Yes.

I have tried several things. Currently trying hide my applist module from lsposed, but I'm not sure I'm doing it right.

Tries both using blacklisting my root apps and using the template on Santander and whitelist everything and applying the template in Santander. Neither worked.

How did you do?
[Magisk] J.Michael:
I do not understand "it does not come out install".

There have been posts about "Latest" saying "not available" instead of naming the version. This is not a serious problem.

If, when you say "remove and reinstall Magisk", you mean uninstall the Magisk manager app and install a Magisk manager app APK: This will not "screw" the "root".
[Magisk] jon214m:
You did the same thing I did 2 years ago, I have the same exact issue and then it became a problem.

This is how I fix my problem .I think what happen was i forgot to unhide the magisk before updating to Beta ,then no Root , exactly same picture you have.I only found out the solution by trial and error by installing back the Stable then Beta again maybe 4 times . Until I noticed that .

Zygisk No

Ram No

As it turns out I still have the Stable Version in the System , cause I forgot to uninstall it or Unhide Magisk before going to Beta .You have to rename it too when hiding Magisk app to hide root ,so I did ,Well it works!😂 ,Root hiding now, I forgot the name I change it to.😅 I've ditch that 26.1 after that.

Just Flash the Latest Magisk Stable Zip.

You should be Rooted. Then go to just go to Magisk settings and do your thing there. If any apps detected Root or Prohibits you to use their Apps , put them on Denylist . Most of my Google apps is on denylist, cause we all know how much of a pain is the @#$ they can be.
[Magisk] pndwal:
Sounds like a network issue... Is internet working? Using WiFi? Maybe firewall settings in router or device? Ad blocker setting?... Gan you see GitHub in browser?...

Don't need to worry about stub. It's for Hide the Magisk app function... It is also embedded in the main apk package but is available separately as App can call this online... PW
[Magisk] gallegonovato:
Good afternoon @J.Michael

Thank you very much for your reply and help.

I am sorry if I have explained myself badly. I have a mobile with Lineageos and I use Magisk. When I open Magisk on the main screen, there is a section at the top that says Magisk.

And just below another one that says App. In this last version 26.1 is installed. But just between the big letters that says App and installed should be the latest version available. And just to the right an icon that says install. But it does not come out either.

I upload an image of Magisk in a previous version and in the latest version as it comes out to me. With some marks to see the difference and try to explain with images what I say.

So I do not know if I'm missing something to install well. Or if something failed in the installation.

Or if I can put the old version, for example uninstalling this new one. Without having to do and load all the Lineageos and so on again.

Best regards
[Magisk] pndwal:
Do you mean you had Magisk Installed = N/A issue?... But this member has App Latest = N/A... Could also be channel set to custom etc, but member tried different channel settings... PW
[Magisk] gallegonovato:
Good afternoon @pndwal

Thank you very much for your help and time.

Both mobile data: 3g, 4g, 4g+ work flawlessly. WiFi and WiFi 5 as well.

I have Afwall but I have Magisk traffic allowed. And it always came out and worked correctly for me until this version.

I tried downloading (and installed Magisk again) the apk from https://github.com/topjohnwu/Magisk/releases/tag/v26.1 and nothing.

I always updated Magisk, from Magisk itself. And the stable channel. And no problems.

Everything seems to work fine. But it seemed weird to me that difference from the previous stable version to this new one. And if it happens to you guys the same or not.

A hug
[Magisk] pndwal:
Try with Afwall disabled?... PW
[Magisk] gallegonovato:
Bunas tardes @jon214m

Thanks for your help and time.

I always update Magisk from Magisk itself. And in the stable channel.

Never use the betas. Since I never changed the update channel. Always using stable.

I do not understand the other thing you comment me to do.

Best regards
[Magisk] jon214m:
"This will not "screw" the "root".

No

🤔But ..

this will lead you to Screw your Root! 🤨

You actually already Rooted .Just needs a little cleaning up is all.And if your not, then Root again . It's Very important to follow the Root guide and procedures very CAREFULLY please . It's sucks an a little fun there fixing your own and only One brick to Phone.
[Magisk] pndwal:
Bit more... Can you see this address from phone browser?:

https://github.com/topjohnwu/magisk-files/tree/9621cf0c31c0355fffcd753cafec9335b45da574

... More importantly, this raw file?:

https://raw.githubusercontent.com/topjohnwu/magisk-files/master/stable.json

🤠 PW
[Magisk] J.Michael:
I thought @gallegonovato was concerned about the Magisk manager app showing something like "N/A" or "not available" next to "Latest:". I also thought I remembered people talking about installing v26.1 when it was first released and getting this -- maybe because 26.1 *was* the latest, maybe because some JSON file hadn't been updated.
[Magisk] pndwal:
Exactly.. but issue with hidden stub + full app coexisting (dual competing apps) is not this... It's symptoms are Magisk (not App) Installed (not latest) = N/A...

No, I think w/ 26.0 people wondered why Magisk wasn't showing Update notification but had channel set to Stable; 26.0 was actually released as Beta!... Only issue w/ 26.1 AFAIK was w/ Release notes link... @Displax made a fix PR for that and John merged already... 🙂 PW
[Magisk] zgfg:
If you block access to:

topjohnwu.github.io

then you will have as on your screenshot:

Magisk app, Latest: Not available

Hence turn off your adblockers and firewalls (AdAway, AFWall, etc) reboot and try again

If it would work then whitelist the above domain (and/or don't use excessive hosts sources in AdAway that may block you the essential sites)

PS: You asked the same in Magisk General thread, see also the answer there