yashsingh1/xdaforums huggingface dataset:
[Magisk] Rockel:
I did not had my day yesterday haha

But yes, the API error should have burned a light already. Thanks for pointing out though!

Google Play Services gets removed after installing Universal SafetyNet. But all the rest of the apps seem to stay intact.

It still passes Safetenet this way.

Seems it's not neccesarry to deny GPS after installing USN annymore. It just works and passes! :)

I just tried the next day, and now it worked!

Made a lot of things clear already.

I've figured out that that SafetyNet still passes when Universal SafetyNet is installed (which seems to de-select the Google Play Services checks). So no worries about it indeed. I was not able to check it yesterday if SafetyNet would pass. But it's fine!

Didn't knew that USN was raking care about this, which makes this verry clear now.

Thanks!
[Magisk] oulouloul:
OnePlus 9 pro, oxygen os 12 c44 stock firmware, magisk 24.1 installed and have root access, changed magisk app name, flashed and working props, flashed Universal sn. I can't pass CTS profile.
[Magisk] TaZeR369:
Is it possible to pass safteynet without google play services, whilst utilizing microG's spoofing?
[Magisk] pndwal:
For most users it won't pass without it. (...SafetnNet Fix!)... Is your device very old?

Nb. If anyone uses solutions like this, please read the release notes, and read earlier version changelogs to understand basic operation (& what you are allowing on your insecure modded device 😬)...

Failure to read release notes is a major reason for the repetition here! 😕

In the case of USNF, it's all on one GitHub page... Just find 'releases'... PW
[Magisk] lordmd:
Some feedback from me:

I tried to avoid using beta - heard of Zygisk before though. Not it finally seems to be released at the stable release channel. Udated yesterday. I am using a Poco X3 Pro (European version, latest stock ROM).

Previously I used Riru, UniversalSafetyNetFix, LSPosed ... and the Magisk Hide I think.

After the upgrade LSPosed here from some thread + official Github Release of UniversalSafetyNetFix - seem to work fine with Zgyisk (which still is labelled as Beta in the manager). Hope the LSPosed will also have the releases officially at Github or somewhere ... soon. (The version I used was from here from some thread where someone posted it.)

Device is certified + Netflix showing in PlayStore. I think the main thing important here was the SafetyNetFix - not using denylist.

For an app of my public health insurance (Germany, strict data protection laws lol) - denylist was required.

For my online banking app ... strangely (before I thin I used MagiskHide) ... just enabling Zygisk (not even enabling/trying denylist yet) - was enough to make it work. While without Zygisk it gave a problem.

(And weirdle the app of my health insurance company ... without SafetyNetFix + no denylist - it recognized modifications but allowed to still use it - after confirming. When using the SafetynetFix it absolutely blocked it with no way to manually confirm to still use it lol. After using denylist - everyting thine though.)

I think this is a good feature - since most stuff that acutally caused problems ... was stuff where I did not actually need modifications - so disabline (denying) Magisk completely - is a good option.

Now I just hope there actually aren't going to be any apps in the future ... that still "recognize" that there is Magisk (even though you disabled it and they should not be affected by it so not needing to recognize it and blocking access from using the app).
[Magisk] pndwal:
What have you set with MHPC?... Why do you need it w/ stock ROM?

Try with ONLY UNNF module enabled to eliminate problem modules... PW
[Magisk] oulouloul:
You're right. I don't need it with stock but I just try and try. I can't pass CTS, I have to use my banking app
[Magisk] toejam119:
I'm not sure but it seems your NFC is just disabled? Try enabling it.
[Magisk] zgfg:
Update to the latest Shamiko v0.4.1(95) directly through your Magisk app, Modules👍👍👍
[Magisk] pndwal:
Simply, because people want to use bank apps (and other favourites that detect 'root').

Many using pre Zygisk Magisk users were using modules and other solutions to allow them to use their bank apps that detect 'root' using means other than SafetyNet API. Many of these solutions including Riru-Unshare and Riru-MomoHider no longer work...

Riru integrated a solution to hide itself and Riru modules from bank / other apps. John included no such ability to hide Zygisk / modules. Shamiko is the solution for this. And it has been improved to hide isolated process leaks and other 'suspicious traces' as well.

You don't need to be concerned with this unless you use a bank or other app that won't work with Magisk root without it, but in that event it may suddenly become relevant for you. 😛
[Magisk] pndwal:
So did you try with ONLY USNF module enabled to eliminate problem modules? PW
[Magisk] pndwal:
Latest Shamiko

### 0.4.1

1. Add more hide mechanisms

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-86343869

👍 PW
[Magisk] oulouloul:
Yes. Ive passed cst now. All passed. BUT my banking app is using different detection method I guess. it says your phone is rooted, even I passed all safety net procedures.
[Magisk] pndwal:
Try latest Shamiko; see posts above. 😜

Was issue a module? PW
[Magisk] pndwal:
Should clear app data before each test in case caches previous detection result... PW
[Magisk] Ace_Cole:
Now it works. 😀

Updated to latest 2.14.7 from 2.14.5

App added to deny list.

Thanks
[Magisk] J.Michael:
Why no mention: @Ace_Cole using Magisk delta; @pndwal not?
[Magisk] Ace_Cole:
I mentioned earlier having Magisk delta.. so nice 😊
[Magisk] itt533:
no, it does not. It says "Fail". Should Google play services and google play be in denylist?
[Magisk] zgfg:
That must be covered by Universal SafetyNet Fix (USNF) module

What is exactly your Magisk version - please screenshot the Magisk app main window

Zygisk is enabled, DenyList not enforced - please screenshot

What version of USNF you run - please screenshot from Magisk Modules tab

Do you run a custom/not'certified ROM - in that case you might need to spoof fingerprints, but let's first clarify ay above
[Magisk] m0han:
Tried an app that does various checks: https://play.google.com/store/apps/details?id=krypton.tbsafetychecker
[Magisk] zgfg:
All and everything green on my side (with TJW Canary)

But very BASIC question - do you properly hide all those detected LSPosed modules from TB Checker by use of Hide My Apps

(Also, did you checkmark DenyList or Magisk hide, whichever you use, for that TB Checke)

Whenever you install a new checker or a 'banking' app, always do those two things (and reboot) before running that app. In most cases that should be ok (but if you don't do, then you can expect troubles)
[Magisk] dohanin:
Interesting. I just tried this app which can detect Magisk Random Package Name.

Tried with Magisk app disabled -> not detected; with Magisk app enabled -> random package name shown.

This aligns with some banking apps which detects root only when Magisk is not disabled. Maybe they have similar logic behind.
[Magisk] zgfg:
I don't hide Magisk app and I don't disable it. I use Hide My Apps to hide Magisk app from eg this TB Checker (and all banking apps and similar)

And it passes

As posted above, Hide My apps also successfully hides my four installed LSPosed modules (incl. the HMA itself) from TB Checker - and everything is green
[Magisk] dohanin:
Yep, understood. HMA is a good method to hide Magisk app. I don't use it because I don't need the other LSPosed modules, so I simply disable the app when not in use.
[Magisk] m0han:
All green now on Magisk Delta Canary c403c77 (25101). Magisk app not disabled » random package name not shown. (I'd forgotten to hide Magisk app from TB Checker.)
[Magisk] pndwal:
No!

You should never need Google Play, and won't need Play Services unless you are using Magisk with MagiskHide, ie. <23.0 if official (whence MagiskHide toggle will add one or two processes in Google Play Services automatically), or trying to pass S/N with Magisk 24.0+ using Universal SafetyNet Fix module 2.1.1 or earlier (possible on some devices) or w/o USNF (eg if running Android 7 or earlier; Nb. Latest USNF can be used w/ Android 7 however).

... But to put things simply, you should pass SafetyNet with nothing more than Zygisk Yes (Magisk App, Home screen), and Latest Universal SafetyNet Fix module active on a certified stock ROM as long as no modules (or possibly other mods) are breaking Safety net. (No need to put anything in denylist.)

If you are on an uncertified ROM (eg China region stock, some beta or preview builds or custom ROMs that don't manipulate props to bypass proper SafetyNet attestation), you will likely need to set the security patch prop date to match, and possibly set, a Google certified device fingerprint prop to spoof a certified ROM / device...

For this, the simplest method is to install and configure MagiskHide Props Config module using a terminal emulator to replace the current fingerprint prop with a known working one from the MHPC fingerprint list, which will also adjust the security patch prop date... Choose one matching your device as closely as possible if required...

🤠 PW
[Magisk] itt533:
magisk v. 25.1 (25100)

zygisk : yes (enabled in settings)

enforce denylist disabled

USNF v.2.3.1 by kdragOn

denylist Unmount v.0.4 by mywalkb

Rom: LOS 18.1 official (LG V20 h990) with swan kernel
[Magisk] zgfg:
See the detailed answer #1993 from pndwal
[Magisk] etmatrix:
Sorry for the delay, be.keytradebank.phone bypass denylistunmount and shamiko.

I don't know if detect zygisk or use a good method for detect magisk.

This app uses a method which is also used in other apps, maybe a library.

Shared library is encrypted, I decrypted it with frida and fixed with sofix, but is not easy to decompile.
[Magisk] pndwal:
Clue: Official LOS will never manipulate props to bypass SafetyNet... PW
[Magisk] ipdev:
Hi all. 🙂

Just to expand on what pndwal mentioned. 🙃

Custom roms use an official (normally the latest/last) certified build fingerprint.

LG V20 (Global) h990

LineageOS - [GitHub] - [android_device_lge_h990] - lineage_h990.mk​

Starting with Android 8 [Might have been late Android 7 :unsure:].

The certified print requires the corresponding security patch (date).

Example.

Spoiler content hidden.

---

Lineage will not allow security patch spoofing.

Matching the security patch to the certified fingerprint used.​

Devices that still get monthly manufacture updates normally pass since lineage updates the build fingerprint to the current manufacture print.

Pixel 4 and newer do not need to be spoofed because the certified print is current (same security patch as the los build).

Starting in November (2022) Pixel 4 will be End-Of-Life and not get an update.​

November Lineage builds will be out of sync (ahead of the certified patch level).​

So you will need to adjust the security patch level back to October for Pixel 4.​

Cheers all. :cowboy:

PS.

Just for reference.​

Requirements for an official build.​

Lineage - [GitHub] - Charter​

​

LineageOS - [Gerrit] - open - merged​
[Magisk] Stillhard:
No problem here, i managed to launch the app and go to markets, but other menu need to create a profile

Where's is the detection? Right after you launch it or after you created a profile?
[Magisk] itt533:
[ ... ]

yes with magiskHideProps and a stock fingerprint it worked.
[Magisk] pndwal:
Woops! ... I have previously gone by this:

https://github.com/Magisk-Modules-R...f/blob/master/README.md#not-passing-safetynet

... Guess this doesn't describe the issue well then... had suspected that... Seems it should really read:

Apparently 'Android built after March 16th 2018'...

Thanks for clarifying... I should have followed MagiskHide Props Config discussion more closely, but confess I only have the basics down...

Now I see that for Android later than March 2018 at least, it may be that editing a second prop, ro.build.version.security_patch, is more critical...

It seems that for many custom ROMs (most?) it should be possible in fact (and may be useful) to keep the original fingerprint, and just adjust ro.build.version.security_patch. However for most users simply choosing a MHPC listed print will be the simple solution as it will properly (excuse pun) adjust both props:

https://github.com/Magisk-Modules-R...E.md#matching-the-android-security-patch-date

... I've now also adjusted statements in my posts above as follows:

FWIW, LineageOS general policy re. SafetyNet:

https://www.lineageos.org/Safetynet/

Further:

https://wiki.lineageos.org/faq#my-device-doesnt-pass-safetynet

Thanks Doc. 👍 PW
[Magisk] rseiler:
New to Magisk and so am just catching up, but I noted this release note for HMA 2.3.2, which predates the current iteration of Magisk by quite a while. Given all this, is it a good idea to use at this point (not you, since clearly it's working, but others) vs using Magisk's built-in hide feature?
[Magisk] pndwal:
Thats a valid concern (users should be aware of bootloop trigger / potential)...

However, w/ some apps, eg S-pushTAN (many others), both (differing) methods are needed currently:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-86053233

👀 PW
[Magisk] itt533:
Is there a way in LOS to get info such as the charging current, realtime up/download rates? Also i'd like to get battery level displayed on the lock screen, and if possible, the charging current.
[Magisk] zgfg:
For a charging icon, check the GravityBox module for LSPosed (but IDK if A12 is supported).

For the rest you could mainly check somewhere about the LOS (TG channel, corresponding thread or so)
[Magisk] itt533:
by mistake posted here
[Magisk] 562TOKER:
Chase Bank app detects root with magisk on last update or maybe just when you tried to add new zelle contact On pixel 5 Android 11. Anyone has the same issue or just me?
[Magisk] rseiler:
@562TOKER I'm using 25.1. I can login to Chase app (I haven't even added Chase to the DenyList, either) but can't test Zelle because I no longer have a Chase checking account. As I recall, you can use Zelle via their web site (once logged into your account on the web), though I may be thinking of another bank. If you find another way to trigger aside from Zelle, let me know.
[Magisk] 562TOKER:
I can log in and use the app normal and just now that I tried to add new contact to send through zelle on chase it detects phone is rooted and can not use service
[Magisk] rseiler:
@562TOKER With all the fraud surrounding Zelle it's not surprising that's where the most checks are, but do you have the app in the DenyList (enforced)? Maybe that will help, but perhaps you'll have to clear Chase cache/storage and reboot.

BTW, it is available on chase.com.
[Magisk] m0han:
Fox's Magisk Module Manager updated to 0.5.4

https://github.com/Fox2Code/FoxMagiskModuleManager/releases
[Magisk] gaduaxe:
Same problem while HSBC banking app detects root, any solution

Thanks so much
[Magisk] dohanin:
Have you tried disabling (freezing) the magisk app besides adding the HSBC app to denylist? It works for me. (Magisk stable + Zygisk + Shamiko + USNF).
[Magisk] rseiler:
Do you recommend something in particular to do that? It's one thing that I've never really considered before. Have you found that to be of greater value in general than the Hide the Magisk App function?
[Magisk] zgfg:
AirFrozen is really friendly and useful and it's been mentioned here couple of times (actually, long ago I heard about here and started to use, not just for Magisk app but mainly for one-click disabling/enabling tons of apps that I rarely use)
[Magisk] dohanin:
Hiding the Magisk App (i.e. random package name) does not prevent some apps from detecting it. I tried this security checking app -->

Edit: this one

TB Checker - Play Integrity - Apps on Google Play

All in one tools check android devices

play.google.com

and it is able to detect the Magisk randomised app. But once the Magisk app is frozen, it could not. Probably the HSBC app is using similar method.
[Magisk] gaduaxe:
Thanks but still not work
[Magisk] dohanin:
Remember to kill the app and probaby need to clear its cache as well, and try again.

Which country version is your HSBC app? I use the UK version and this method works fine for me.
[Magisk] rseiler:
Interesting. I'll check it out. In addition to creating root, I assumed that Magisk needed to be resident in at least some way to do its ongoing work related to app compatibility, but if it's frozen that's apparently not the case. If the only time that it needs to be unfrozen is when you need to change a setting/update a module etc., then that sounds like a good way to go.
[Magisk] zgfg:
Actually, most features (managing modules, DenyList, etc) can be done through the magisk commands in Terminal (not friendly but possible).

Ie, Magisk app is nothing else but (UI friendly) Manager (its old name) - it's not the Magisk ("service') itsekf
[Magisk] J.Michael:
"Magisk" *does* need to be "resident". You have been advised to freeze "the Magisk Manager app".

You can see if freezing could possibly help by uninstalling the Magisk app -- not Magisk, the Magisk app. If that solves your detection problem, you might find the freezing more convenient than repeatedly uninstalling/reinstalling.
[Magisk] rseiler:
Unless I'm missing it, AirFrozen doesn't list Magisk when you've enabled its randomized name feature ("show hidden" didn't help, and neither did using the list function in Settings to add apps), so is it not meant to work in tandem with that feature? I'm not sure why merely renaming something could hide it so thoroughly given that this app seems to show every other last thing, including deeply obscure system apps.
[Magisk] zgfg:
Of course it does not list Magisk since Hide Magisk app renames it - you must look under the name you gave/confirmed (by default it's Settings or something like that)

Unhide and hide gain and this time pay attention how you renamed the Magisk app when you ran Hide Magisk app
[Magisk] rseiler:
Yes, I should have clarified that. I'm not look for "Magisk" but the new name, which is listed in Magisk, so there's no mistaking it. It really stands out since it's an unusual, short name. It's just not there that I can see.
[Magisk] zgfg:
No problem on my side

I hid (renamed) and THEN opened AirFrozen (maybe it scans for the apps when opening)

See the screenshots
[Magisk] rseiler:
Got it, thanks. I was looking for the package name. I forgot that yet another name was involved (and a very poor one at that--Settings--I'm going to change it), and that's the name it uses. And I didn't notice the icon, which also would have clued me in.
[Magisk] bomblader:
Is it possible to find out what an app detects? I have Shamiko 0.5.1 installed and somehow a banking app still detects root. This is the app: https://play.google.com/store/apps/details?id=ro.raiffeisen.eToken&hl=ro&gl=US
[Magisk] dohanin:
I just tried it on my phone (stock rom, Magisk 24.3, Shamiko 0.5.0, USNF).

Without doing anything, it detects root.

Adding it to denylist, still detects root.

Freezing the Magisk app, goes through!
[Magisk] HippoMan:
It's now been reported a number of times that freezing the Magisk app helps thwart root detection in many cases.

So ... I now believe that what we need to do is not talk about that publicly too much, so that the banking-and-other-kinds-of-app developers who might check these forums don't catch on to the fact the Magisk app itself doesn't actually provide any run-time Magisk functionality.

This way, those developers will keep thinking that checking for the existence of a non-frozen Magisk app itself is sufficient.

Given the intelligence level of some of the banking people who lamely think that it's important to block root access under Android in order to "protect" their provided banking functionality, this ruse might actually be quite effective in many cases.

After all, anyone who accesses a bank via their desktop computer is doing so on a rooted machine, and those idiotic banking software designers don't even care about "protecting" us against that. And those same banks issue us debit cards that we carry in our stealable wallets, and they don't prohibit us from using those debit cards, either. They go crazy only over trying to protect people against rooted Android devices, which are no more insecure than desktop computers and wallet-borne debit cards.
[Magisk] bomblader:
How are you freezing the magisk app? I'm using this tool to disable it. (it's also in a custom package already) https://github.com/MuntashirAkon/AppManager

But it's still detected somehow. The only detection (suspicious trace) Momo shows is "TEE broken"

Magisk 25.1 + Shamiko 0.5.1 + USNF 2.3.1

LE: same thing with AirFrozen, still detected. I'll try to freeze a few more apps that require root.
[Magisk] zgfg:
That's all fine. But as you can see you have every day a new newbie who asks the same and same questions - how to prevent root detection from that and that app

Those newbies are not just lazy to read/follow the discussion and to know general techniques that work for let's say 80% of 'banking' apps, but they will even bother and ask again about the same app that has already been answered just a day or two ago

It's to hard for them to search and read the posts, and then to experiment and learn

It's much easier to ask for every detail, requesting them not justnthe others to read their posts (as said, they do not bother to read what the others had previously discussed) but theyb expect others additionally to waste the ime on answering something that has already been covered manyl times

How then to keep some techniques as 'secret'?
[Magisk] zgfg:
It's been discussed eg yesterday about AirFrozen

Is it really that hard to spend some own time to read ( in this case just the last dozen of posts) and get informed before/instead of repetitevely asking the same things?!

How some techniques to pass root detections could be kept 'secret' if they have to be repetitively described many times. In that case, a technicique that works now, soon will no more work because 'banks' will know very well how one can trick their detections, and soon they will close those known holes and improve their apps and detections
[Magisk] rseiler:
Not that sure apps are primarily concerned with root even when they explicitly mention the word in the error message, because I ran for a while just being in violation of "verity" (i.e. unlocked bootloader), and that alone is enough for some of them, including GPay.
[Magisk] dohanin:
It doesn't really matter as long as you see the Magisk app disabled.

hmm... I don't have this trace.

I'm not freezing other apps that require root, so I guess it may not be the cause.

Make sure you killed the app and cleared its storage before trying again.

Also, I stayed in the earlier versions of both Magisk and Shamiko because my another app detected root when using the latest verions (my post here). It could be similar for your app. Of course there are other possibility.
[Magisk] pndwal:
Bootloader status is the very beginning of an AVB / SafetyNet API 'chain of trust', and the term 'root' is often used very loosely to indicate simply that this 'chain' is broken... In this context it is often synonymous with 'jail-break' etc; ie. Read 'compromised', 'Trusted Execution Environment' is broken...

Are you sure App itself is detected?... Have you tried with app simply uninstalled to see as has been suggested?... Nb. You won't lose any settings; can simply install apk again later, then hide again...

I'd be surprised if banks act on that one.

My guess is that for affected devices with incompatible (buggy?) keymaster implementations (e.g. many OnePlus devices), this ' suspicious trace' will be detected even when fully stock & B/L locked.

FWIW, this failure on the part of OEMs seems to be a major factor respecting the reason key attestation has not yet been fully enforced (ie. this has allowed devices w/ flawed keymaster to pass SafetyNet regardless).

Are you clearing bank app data before each test (after every change to environment)? PW
[Magisk] zzz2002:
If you freeze the magisk app, do you need to hide it.

I assume the answer is yes, but just curious.