yashsingh1/xdaforums huggingface dataset:
[Magisk] skia16:
We are discussing this app right now 😅...I spend almost 4 days searching information and try different methods... unfortunately all methods found didn't mention my banking app...as I said we are discuss this app right now....I tried a method that work for another user (I don't remember his nick...check some post above....I will retag him) but not for me (I guess different devices...I'm using a pixel 7a (lynx)...obv i thank so much him for spending time to try this solution especially with a banking app that probably he didn't use (it is an Italian bank)...anyway sorry if I disturb you
[Magisk] skia16:
post #3484 @WholsJohnGalt1979
[Magisk] zgfg:
Ok, sorry I was not aware.

U was triggered by your generic post saying:

"Man...I have tons of apps that need to be hidden...how can I hide the apps?"

So I answered to that post (with no specific name of the apps, general question how to start hiding, etc

Unfortunately, this is a generic situation that repeats very often where new ppl just jump in and ask similarly
[Magisk] beeshyams:
The number of ways banking apps check is crazy. Found a new one- citibank India app used to work fine with repackaged Magisk, Configure deny list and enforce.

For the last three weeks it wouldn't work. Discovered today, it doesn't play with Adguard. Need to disable everything in Adguard except VPN and it works.. Phew a relief

May help somebody
[Magisk] WhoIsJohnGalt1979:
Any chance of you going through the Adguard filter logs and see what is getting blocked while accessing citibank which you can whitelist. Secondly with the new interface you can also use the Firewall feature to allow Citibank India traffic to not flow through Adguard. Is a lot more convenient than having to disable Adguard every time you access the app. Good luck.
[Magisk] WhoIsJohnGalt1979:
Attached is the blacklist template that I use with HMA and apply it to what ever app that needs to be impacted by it, namely root detection apps, banking apps etc which dont work beyond the usual Deny list addition. Also when you are trying different things, once you see a detection, please remove the app from deny list, delete data and uninstall the app and reboot, then install the app back, add it to deny list ,delete data and reboot and then try out what ever you are attempting. If an app has already given you a negative report, doing something and checking again with the app will still give the same negative report. Same thing with HMA, please dont forget to reboot everytime you make any changes to the template. Am just citing the obvious here nothing complicated. As I reported earlier, and I dont use the Banca app so I currently have it uninstalled after testing, with "Magisk Alpha 26301, Banca in Deny List, Deny List not enforced, Play Integrity Fix 8.4, Shamiko 0.7.3(174), Banca using my blacklist template in HMA, USB debugging disabled (temporarily)" the Banca app opens just fine.
[Magisk] beeshyams:
I should have been more clear. I used the firewall rules not disable adguard, which is quite cumbersome. I didn't check the logs then.
[Magisk] skia16:
I follow every single step on this post but no luck. It only works with an older release of the banca app. Do you mind if I ask you to try again and tell me the version of my "Banca" app. I suspect a device/software problem. I try latest version of "banca" app on my old OnePlus nord (Avicii) with android 12 oxygen os 12, magisk 26300 (manager hide with package name change), zygisk, denylist enforced with only "banca" app and playintegrity fix and works perfect (phone with fresh factory reset so empty of apps and data)
[Magisk] WhoIsJohnGalt1979:
Kindly don't take me the wrong way, but if you read my post/s, i am using alpha magisk. There is some zygisk native bridge implementation which I do not have the technical expertise to explain the nuts and bolts of to you; which allow relatively better hiding of zygisk. From what I have read, the features of alpha would be migrated to stable in the form of magisk 27 in the future. Now its your choice; if the usage of this banking application is too important for you, kindly move to magisk alpha from stable magisk that you are currently using. However please be informed that support for alpha is extremely limited here, so I would recommend if everything else is working for you using stable magisk and zygisk except for this app, use a browser or something for the bank. You dont have to make this decision for your phone which has way more usage than this app, UNLESS you do business out of this app from your phone and dont have a laptop or Morphius gave this app to you as your red pill in which case lol I am more than happy to show you how to migrate to magisk alpha. Regards.
[Magisk] skia16:
I will use a browser...but I explain the question bad. I install magisk stable in the old OnePlus device but in this (pixel 7a) I install alpha as your instructions but "banca" app won't work
[Magisk] WhoIsJohnGalt1979:
Sorry to hear that. Basis your request, I again installed the app, sharing screenshots, i dont understand the language but seems its working fine on my end. Reboot
[Magisk] pndwal:
So I gather we're discussing Banca MPS...

I can confirm it opens fine with much the same setup on my stock MIUI Android 11 device:

• Magisk Alpha 26301 (builds WIP native bridge loaded Zygisk from LSPosed Metagisk experimental fork, zygisk branch, with more hidable 'anonymous' memory per original hidable Riru concept)

• Banca MPS in Deny List, Deny List not enforced

• Shamiko 0.7.3 (174) (now supports NB-Z)

• @Displax Modded USNF 2.4.0 ver 2.0 (nb. use mod version 1.3 for devices launched with A13)

• Banca MPS using blacklist applist hiding in HMA

• Alpha app hidden as obfuscated stub app (take 'Hide the Magisk app')

° [Didn't need Developer options, USB debugging, or OEM unlocking disabled]

... With the same setup but using TJW Magisk 26301, I get the "Access prohibited - Cannot log in. Your device does not comply with the security parameters set by the app" notice:

😜 PW
[Magisk] mGforCe:
Yes, I dread before updating bank apps these days..

Kotak with last update has stopped working for me too.

By the way Citibank IN (v 23.7.1) is working fine for me with Adguard VPN enabled. Just checked after seeing your postz as I have it in my phone but don't use the app regularly.

PS: My setup is A13, Magisk Delta + Zygisk enabled, Shamiko, HMA etc.
[Magisk] mGforCe:
Interesting...related to Adguard but to make an app to work on rooted phone..

don't remember where exactly but few days back read about an approach which said

Select few apps like webview, market feedback in MagiskHide / configured in DenyList

alongwith Block access to firebaseremoteconfig.googleapis.com

This was the solution to make root detection gone.

I had tried it that time and it did work. Didn't go into specifics but found it surprising what all level bank apps are going to detect if device is rooted.
[Magisk] beeshyams:
It works with Adguard VPN but need to bypass other Adguard gestures like route traffic through Adguard, filter app content/HTTPS

My root set up is simple configure and deny list
[Magisk] pndwal:
🤔

Yup, blocking Firebase Remote Config API

worked for a while with Starling bank (others?)...

But this simply facilitate the following:

Seems Starting tested their enhanced Zygisk detection etc serverside per:

https://firebase.google.com/docs/remote-config/

and later merged these detections in-app at which point users have needed to find proper bypasses (and still haven't in the case of Starling bank)...

Someone just discovered the way to circumvent app changes applied from server-side while it lasted in that case! 🤪 PW
[Magisk] mGforCe:
Ok.

I double checked, for my Adguard VPN, had disabled protection/route traffic for all bank apps, sensitive app etc (being paranoid that data might be read). Hence may be I never faced issue.
[Magisk] mGforCe:
I don't remember, but one of Indian Bank apps was detecting root, when I read that, so just applied

haha, it's a cat and mouse game.

Thanks for detailed reply.
[Magisk] HippoMan:
... and the cats are going to win.

I refer to the felines in the plural, because they consist of an ever-growing population of developers who are making a point to install anti-rooting and anti-modding capabilities into their apps. And an increasing number of these apps have nothing to do with banking.
[Magisk] Nergal di Cuthah:
Yep, mcdonalds, lg's tv app, some random pool game? no reason they shouldn't work with root
[Magisk] Wolfcity:
After several attempts failing while on Magisk 26.2 stable/Magisk alpha (with LSposed zygisk, HMA) I got latest S-Push TAN (v4.2.3) now working with only latest

Magisk 26.3 stable (hidden) and

USNF v 2.40-Mod 1.2 by Displax.

S-Push TAN on denylist, denylist enforced, zygisk activated.

No LSposed ,no Shamiko,no HMA.

Device: Xiaomi Mi9T (Redmi K20)

Xiaomi.eu 12.5.2 (Android 11)

Thanks to all the users testing and reporting especially @pndwal .
[Magisk] pndwal:
Wow, that's an old post replied to (20 months)! 😜

Since my bypass for dex pattern matching detection use by PushTAN (using both obfuscated Magisk and HMA) stopped working at least on MIUI devices, things have changed...

I got S-PushTAN working again with NB-Z in Alpha Magisk + Shamiko (HMA not needed)... You saw the post:

https://xdaforums.com/t/discussion-magisk-the-age-of-zygisk.4393877/post-88467665

- Just confirmed it (4.2.3) is still working with this setup...

Very interesting you've now got it going with basic Zygisk enabled and no proper hiding module however!... Used to be the benchmark bank to crack!...

Maybe they've abandoned Promon security engine... Got too expensive?... Or maybe Zygisk detections were really Zy-module leaks and Shamiko (LSP) Devs are possibly concerned only with hiding native bridge based injection/hooking now?

Anyway, hope it's still hidable with bump to Magisk 27.0 one way or another... 🙃 PW
[Magisk] dipseeet:
you got it working again without PlayIntegrity fix or similar modules?!
[Magisk] pndwal:
As described... PW
[Magisk] Wolfcity:
Yes,sorry to dig up that old post but I thought (if it's Magisk 26.3/Xiaomi related) it may be useful for some other users with that configuration.

I was astonished by myself that it worked that "easy" way.

But as S-Push TAN is showing up here and there I thought it may be useful.

I will see how long it will be working this way.

But again, thanks for pointing me to the right direction and giving me the needed information. I know what to do if problems occur.😉
[Magisk] addas4:
Hello, does Momo detects Zygisk traces? I have the same setup but Momo detect Zygisk traces.

I am running Magisk Alpha 26301 (7826d752) (DenyList not enforced) & using HMA

My modules are:

• SensitiveProps by HuskyDG

• Energized Protection

• Fake Encryption

• Hide modified init.rc

• KnoxPatch Enhancer

• liboemcrypto disabler by ianmacd

• Magisk Bootloop Protector by HuskyDG

• MHPC

• Root Masker by Levi_Marvin

• USNF v2.4-2.0 by kdrag0n & Displax

• Shamiko 0.7.3

• LSPosed Zygisk v1.9.1 (6997)
[Magisk] zgfg:
IDK why you need MHCP, with USNF latest or (probably better, depending on your ROM) Play Integrity Fix and ofc Shamiko, you should be ok for Play Integrity and SafetyNet

Then, test Momo with a minimalistic setup, and later add your modules one by one and check when Momo starts reporting Zygisk

Eg, for me, Momo detects Magisk only (with BL unlocked and USB debugging)

But when install/enable more LSPosed modules like I am not developer or DevOptsHide, then Momo starts additionally reporting Zygisk and/or Zygote injected
[Magisk] addas4:
Thanks for help.

I uninstalled all LSPosed modules and for Magisk I uninstalled everything except LSPosed & Shamiko & USNF

Still detecting

I am using Android 10 Samsung Note9 as SAR (System-As-Root) because it is an old device
[Magisk] addas4:
Momo detects su & Magisk only without Shamiko, when I flash Shamiko it detects Zygisk but doesn't detect Magisk and su
[Magisk] J.Michael:
Are you clearing Momo's cache before and after rebooting?

Also, nobody needs Momo, it just gives some people a warm, fuzzy, feeling to see it doesn't detect anything.
[Magisk] zgfg:
I think it's just the opposite, Nomo makes people uneasy, seeing that it always detects something 😁
[Magisk] mGforCe:
True... I have not come across "warm" posts. Its always "uneasiness" over Momo

I gave up on momo... passing Ruru is enough for me
[Magisk] addas4:
Hey, thanks for the help.

Yes I am clearing data of Momo

Also all banking apps doesn't work in Alpha which is why I checked Momo, where in the other hand TJW Magisk has 2 banks not working (both with Shamiko)
[Magisk] Catani:
Sorry to bother you again. But obviously you're right. With magic hide it's either the banking app or the Google pay. It's becoming tedious to constantly go back and forth. Isn't there a workaround for this ? I have to reboot my phone each time I have to go between the two. Thank you
[Magisk] J.Michael:
If you can access either or both of these services using a browser, you can eliminate the need to reboot.
[Magisk] Johnn78:
it works like a charm. Any trick to pass the strong integrity ?
[Magisk] zgfg:
Yes but flash back your official firmware and relock Bootloader (it will include Factory reset)

Otherwise not, Google has closed the gap
[Magisk] roslanhashim:
sorry for late reply. the answer yes. still using Magisk Delta. the mention apps work like champ. plus another trick that have to hide Magisk/Magisk Delta apps. the other thing is must hide all Google apps + the sub system apk

eg: com.google.gms

com.google.gms_locale

and so on
[Magisk] RealestMazen:
How do i fix this ?!!
[Magisk] zgfg:
What do you mean by "hiding all Google apps"?

To hide them from whom?
[Magisk] Johnn78:
I have official firmware but locked bootloader. Can I hide bootloader that is locked ? In some other thread I read that safetynet fix 2.4 mod test4 can pass Stong Integrity but in me didn't work & wonder if it exists something similar.
[Magisk] pndwal:
Is that a typo?... Want to hide locked bootloader?!?

... if not and you don't have strongIntegrity even with locked bootloader, see here:

https://xdaforums.com/t/module-play-integrity-fix.4607985/post-89005419

and:

https://xdaforums.com/t/module-play-integrity-fix.4607985/post-89008957

😬 PW
[Magisk] dipseeet:
:(

@pndwal

this app works for you?

Sparkasse Ihre mobile Filiale - Apps on Google Play

THE OFFICIAL APP OF THE SAVINGS BANK - YOUR MOBILE STORE

play.google.com
[Magisk] pndwal:
I think so...

🤠 PW
[Magisk] radasx:
After new update Samsung N9 crash every time when revolut app installed. Revolut random reboot phone.
[Magisk] Nergal di Cuthah:
What does this to do with magisk or zygisk?
[Magisk] radasx:
After update magisk to 26.3 revolut always crash. Work 15 minutes and random reboot phone. After that cannot run app.
[Magisk] dipseeet:
o_O

with Shamiko ON and Force Denylist OFF?!

for me it's not working with Shamiko
[Magisk] J.Michael:
There are problems with 26.3. Read the thread. Or just take my word for it and use 26.1 until you read about people cheering that some new version fixed the problems.
[Magisk] pndwal:
Yup...

... I've taken Hide the Magisk app and assume you are aware I'm using latest Alpha Magisk build with Metagisk native bridge loaded Zygisk... 🙃 PW
[Magisk] dipseeet:
okay thank u a lot

do i have the same version installed?

i have Magisk Alpha 26301

or did u build your Magisk Alpha?!
[Magisk] pndwal:
Yup...

No...

Wouldn't hurt to mention your device, ROM etc...

Also, you have Magisk app hidden and PI deviceIntegrity passing?... Maybe run Momo and post result... 🙃 PW
[Magisk] dipseeet:
Samsung Galaxy Note9 crownlte

NobleRom 2.C Android12

Magisk Alpha 26.3 (26301) (hidden)

LSPosed 1.9.1 (6997)

Shamiko 0.7.3 (174)

yes

yes

###

RESULTS

Momo (Enforce Denylist OFF)

Momo (Enforce Denylist ON)

PI Device Integrity
[Magisk] radasx:
The same with 26.1 and 26.3.
[Magisk] zgfg:
Interesting that you pass Device Integrity with Permissive mode and unencrypted Data on A12 (custom ROM)

But you cannot 'hide' that and other apps (like Momo does) will detect

With Shamiko, Enforced DenyList MUST be off, but must be populated (eg, Momo in the list) - BCS, Shaniko will read the least

For TWRP detection' - delete TWRP folder (or rename to eg TWRP.bak)

You will also have troubles with XPrivacy Lua (and you'll need to manually delete some files, it's described on their GitHub and no other tool will do that for you) - read in this thread, and/or other similar threads, discussed for other users who came with XLua
[Magisk] dipseeet:
must be populated?!

internal only external also?

:(

i don't use XPrivacy Lua
[Magisk] zgfg:
I don't understand Polish (?) but it seemed to me that your last screenshot showed that you had XPrivacy Lua installed

DenyList - you know what is it for, so you have to use it (check-in Momo, other detectors, banking apps) and reboot

As said, delete TWRP folder from Internal memory if you don't want that Momo complains about.

I didn't say that you uninstall TWRP

Btw, please take some time to read this thread and similar ones. All these questions (and other similar ones you may have later) have been many times asked and answered
[Magisk] dipseeet:
^^ maybe it's another Member

:(

iam using it already since it's the "new" MagiskHide

i'll post my DenyList ...

:)

okay nice, good to know

:D

i already took a lot of time to read not only this Thread but also a few others

and i was in a try&error process in the last 3-4months

this is my DenyList

10days ago i posted this:

everything is working fine and i never used Shamiko

by interest i was trying all those Apps also with Shamiko and i found out that

Sparkasse

is the only App where i HAVE to force DenyList

bcos when my DenyList is not enforced and Shamiko is working then Sparkasse won't open

another reason why i wanted to try out Shamiko is that i'am using LSPosed and when Apps are in the DenyList and the DenyList is ENFORCED then those Apps won't get affected by any Module in LSPosed

with Shamiko and enforce DenyList DISABLED those Apps still work except of Sparkasse

Sparkasse IS working for me only when i ENABLE enforce DenyList no matter if Shamiko is installed or not

but i would like to use Shamiko

that's why i asked if this Sparkasse App is working for ya'll WITH Shamiko and enforce DenyList disabled

(^^ ok i only asked pndwal)

what am i missing?!

:(
[Magisk] J.Michael:
Going back a few posts, "populate" means "put things in". @zgfg was reminding you that you had to put some app in the deny list to change the behavior of that app.

The Deny List is maintained by Magisk. There used to be some Magisk function that acted according to the contents of the Deny List. That function may no longer exist.

Shamiko is lazy. Or pragmatic. Instead of implementing a UI allowing you to make a Shamiko list, Shamiko coattails on Magisk: Shamiko can read the Magisk Deny List; Shamiko can tell if Magisk is Enforcing the Deny List. Shamiko will not do anything (at least, will not do anything with the contents of the Deny List) if Magisk is Enforcing the Deny List.

So it is no surprise that you get no benefit from Shamiko unless you turn off Magisk's Enforce Deny List. Turning off Enforce Deny List may not be exactly the same as uninstalling Shamiko, but it comes close.
[Magisk] J.Michael:
What is the same with 26.1 as with 26.3?

(Please don't post screenshots and challenge me to figure out what you thought was significant.)

You said your problems started when you updated Magisk. If you were not at 26.1 before, then imagine me reposting my answer, but replacing "26.1" with "whatever version of Magisk was working for you".
[Magisk] dipseeet:
:)

okay thank u
[Magisk] ipdev:
"That function" still exists. 😉

Magisk's "DenyList" is meant to stop Magisk and revert changes made by Magisk when a process on the list is called when "Enforcing".

It can not revert every change. 🙃️

That being said, I strongly value the ability for apps to fully “opt-out” of modding, and it is important to me that Magisk is able to “get out of the way”, so a minor subset of the MagiskHide infrastructure will remain. Users will be able to assign a denylist of processes where Magisk denies further modifications and reverts all changes it had done.

― John Wo, State of Magisk: 2021​

"Zygisk" will be stopped for a process on the DenyList when called for example.

Cheers. :cowboy:
[Magisk] dipseeet:
i switched back

LSPosed version

from 1.9.1 (6997) to 1.9.1 (6990)

bcoz

with LSPosed 1.9.1 (6997)

Momo detect

Zygisk is injected

and

with LSPosed 1.9.1 (6990)

Momo doesn't detect

Zygisk is injected
[Magisk] pndwal:
App might not like Xprivacylua...

Try @Displax v2.4.0-MOD_1.3 USNF... it has • Fix "stat /sys/fs/selinux" access time reading...

May help... 🤠 PW
[Magisk] pndwal:
Wow, you have a lot more detections than me...

Permissive selinux is bad...

Nb. Shamiko apparently has unresolved issues ATM... it is proper root hiding however... DenyList is not,and is really a developer/testing tool now...NOT the 'new MagiskHide'... rather, John urged 'Devs passionate about hiding' to 'shine by providing hiding modules'... Shamiko hijacks Denylist's list only for convenience but uses it as a hidelist, NOT a denylist which differs as discussed by others above... it should (and normally does) work far better than Denylist... You can be sure Devs are working on discovering the issue... seems it may affect different devices differently too... This from A!pha discussion Aug25:

Note that some apps detect likes of TWRP folder and addon.d in system...

Hope something helps. 🤠 PW
[Magisk] dipseeet:
^^

but some apps are working even if detectors say iam rooted

:(

i know

i read about this and i asked the ROM Dev if it is by default and he said yes

^^

sry for the "new Magisk Hide"

yes it really does

thank u :D

yesterday i installed Magisk Delta by @huskydg

to test if it's working with the

Sparkasse

and those 2 TAN apps

after 1day testing it is working now

at first it didn't worked

in LSPosed i have a few modules installed

if one of those 3 apps is activated in at least one of my modules in LSPosed

then it crashes

i had those 3 apps still activated in 2-3 modules

after i put them out of the modules the apps started to work

Momo still complains about Zygisk etc.

Shamiko is not installed
[Magisk] J.Michael:
Please explain having an app activated in a module.
[Magisk] zgfg:
Why not - there are different apps, developed by different developers, etc, hence they may use different techniques to look for 'root'

And they don't really look only for ROOT (SuperUser privileges in Android) - some may (among other artefacts of modding) look for TWRP folder, hence they just guess that user has unlocked the Bootloader and modified the official firmware.

They generally look are you running the stock/official ROM that was certified, or you have flashed custom Recovery, custom ROM, custom Kernel, etc, or installed Magisk (only that actually being the root)

Many ppl wrongly assume that 'one size must fit all', ie, that all (banking and similar apps) should use the same techniques

After all, those techniques are not free and open source projects, that developers could freely download and build into their apps

Google, on their side, provides (free but black-box) Play Integrity API. However, it can be spoofed (Basic and Device Integrity), and therefore certain apps want to use additional techniques to look for modding

As a result, different methods are required to spoof modding. For some apps (using more primitive techniques) it can be easier, for some it will be harder or even not known yet how to successfully sooof

After all, life will be boring if one method could successfully spoof for all apps😁

Last but not the least, detectors like Momo or Native Test (they practically cannot be spoofed) are developed by developers of Magisk (Alpha), Shamiko and/or LSPosed, hence they really have deep knowledge into the modding