yashsingh1/xdaforums huggingface dataset:
[Magisk] HippoMan:
Biometric and similar security checks are fine with me. Crippling the entire computing device in the name of "security" is not.

Things like man-in-the-middle attacks have nothing to do with whether a device's bootloader is locked nor with whether full system backups and restores (such as via nandroid) are impossible.

Mobile devices — rooted or not -- are equally vulnerable to man-in-the-middle attacks as are desktop devices.

My statement about the lower monetary amount of bank fraud occurring on rooted Android devices is merely an inference (which I believe to be valid) based on the small absolute and relative numbers of people using rooted Android versus those who access their bank via other methods (desktops, non-rooted Android devices, non-Android devices, etc.)

Bank security measures which would require the widespread crippling of desktop devices might be on the horizon, but probably not during our lifetimes (thank God!).

As for cars, up until around 35 years ago, I used to work on my own car. But now I live in NYC and don't need -- nor even own -- a car. So the fact that cars have "improved" (ha ha!) in terms of not being able to be worked on at home does not affect me.

Lots of things occur in the name of "progress" which I don't like and which I believe end up making life less pleasant. I just soldier on and deal with these things, and I do whatever I can to ameliorate their deleterious effects.

One example of such "progress" is the ongoing deterioration of Android.

PS: I forgot to click "Reply" when writing this message, and therefore, the text I'm replying to is not quoted. This is the message I'm replying to:

https://xdaforums.com/t/discussion-magisk-the-age-of-zygisk.4393877/post-89087838
[Magisk] suthar.kalpesh57:
Imobile(Banking app)It was working until new update(17.x) came.

somehow Imobile app is able to find that the phone is rooted, inspite of having everything setup. even detection test shows everything green. (screenshot attached).

Meanwhile all the other banking app working fine it just imobile somehow detects the root.

it will be really great if someone can help me on this. Thanks:)
[Magisk] shadowstep:
The latest version detects LSPosed, so if you're using that, the app will detect it and there's no workaround yet. If you can live with LSPosed, however, then you should be able to make it work.
[Magisk] suthar.kalpesh57:
LSPosed apk is not installed. I am using parasitic manager.

Without LSPosed imobile was already detecting root. That's why everyone is using LSPosed + HMA.

but looks like we are at the limit now.
[Magisk] pndwal:
But seems LSPosed itself (hooking?) Is detected (as "Evil Service (0x2))...

See this and later posts in that thread:

https://xdaforums.com/t/discussion-...third-party-magisk-fork.4460555/post-89085015

🤠 PW
[Magisk] shadowstep:
As @pndwal said above, LSPosed is not only LSPosed Manager, but the framework too... and it's detecting the framework. I've tested and the latest version works without LSPosed. It detects the Magisk App (without HMA, obviously), but if you freeze the app, it opens up just fine.
[Magisk] suthar.kalpesh57:
Thanks let me try that out.
[Magisk] punkbusted:
I installed Sui module which added an option to settings popup. Then I uninstalled the module because I didn't need it but the settings popup option still remained. Is there a fix, maybe some config file I can edit?
[Magisk] HippoMan:
Given the fact that an increasing number of banking-app developers are learning how to program their code to better and better detect rooting and modding, you might want to think about the idea explained here, which I am at least dreaming about and wishing for ...

https://xdaforums.com/t/discussion-...ding-cat-and-mouse-game.4425939/post-89100822
[Magisk] lukypuie:
Pretty much the same.

The app works until you either install the apk when unrooted, or have the boot.img modified with magisk, even after uninstalling the magisk apk, so it also checks traces somewhere, would be useful to check debugs and access to files of that MPS app.

I also tried sandboxing the app through work profiles and sandboxing with Island but no luck at all.
[Magisk] rushiranpise:
New way of hiding zygisk with Magisk / Delta

Shamiko not required. At least for me.

Remove all zygisk modules

Disable original Zygisk from Magisk Settings

And reboot

​

Install ZygiskOnKernelSU from here and Reboot

Note: The latest release v4-0.8.0 shows Found Magisk In Momo app at least for me.

(Hence i use older pre release from the attachment)

After Reboot Install latest Lsposed or this one which i used and reboot

credits: Dr-TSNG /nullpointer (module owner)

​

As you can see zygisk is still disabled but i can use lsposed framework which require zygisk itself.

Note: It will show as module is disabled due to no zygisk available in magisk app,but module should work in background.

I tested this method with original magisk and delta with my device

Also this works with kernelsu on my other device with same method

Apps like Livin Mandri,Zain Cash,Singpass are working

Detection Screenshots:

Spoiler content hidden.

More Info:

Check Module Author Reply

In the end , i don't guarantee, this is a full proof method and will work on all devices.

As, not every device is same. each my have different detection issue.

Cheers 🥂
[Magisk] sawdoctor:
Is this only going to work on Delta or possible on original Magisk as well?

Edit just reread your post sorry i see you already stated
[Magisk] Stillhard:
Could you please try it with itsme ?
[Magisk] rushiranpise:
app not available in my country. downloaded from apk mirror v4.7.0

i can open the app till enter your phone number. cant take ss in app, tried to hook app with disable flag secure but then it crash.

You can use this zip in ksu, and disable any module which causes detection in native test app.

like play integrity fix /usnf need to delete service.sh from module to fix native test app

All i can say is , as long as you pass these apps

momo,memory detector v2.0,native test and hunter

some apps also check for xposed apps installed so need to hide with hma , also hide ksu manager.magisk app with hma .use tb checker and ruru to detect

most of apps will work fine
[Magisk] wyt18:
Do you need to install KernelSU separately? Or just this Magisk module suffices?
[Magisk] HippoMan:
Be careful!

This will only work if your device's kernel is a proper GKI kernel. KernelSU installation requires GKI, and I don't know what might happen to the OS if KernelSU installation is attempted on a device whose kernel is not GKI.
[Magisk] rushiranpise:
?? Irrelevant to the guide I post

There is no need of gki or non gki in the guide method itself

Also,Kernel su supports non gki (just need to self patch the kernel manually)
[Magisk] rushiranpise:
No, if you use magisk why to install kernel su

Just install the module in magisk
[Magisk] pndwal:
Yup, very like LSPosed Metagisk WIP Zygisk as released in Alpha fork because it too uses Native Bridge loading... Probably builds same commits from Shana and Howard...

Nb. Since this is an LSP initiative it will work best with Shamiko hiding... This is like RiruHide (also inspired by @canyie's native bridge implementation adopted by @RikkaW) but that was inbuilt... Of course Magisk no longer integrates hiding so Shamiko is adapted to hide Zygisk in Magisk or standalone modules and has been Native Bridge compatible for a while now.

Nb. 2. Delta does use Native Bridge Zygisk, in fact had it earlier than Alpha, bit it's a very early POC from Maru Dev/fork... AFAIK @huskydg hasn't updated this... It actually works better than native Magisk Zygisk for bypassing some bank's detection but not as well as LSP WIP NB loaded Zygisk which has had countless fixes/commits since March...

👀 PW
[Magisk] HippoMan:
Are you saying that there is no need to be running KernelSU in order for this module to function? If so, that's great!

But if KernelSU is indeed necessary here, I'm sure that many people here (such as myself) don't have any knowledge about nor experience with manually self-patching a non-GKI kernel ... nor even any knowledge as to whether the device's kernel is or isn't GKI in the first place.

If KernelSU is necessary here, then we need to become aware of these items.
[Magisk] rushiranpise:
Yes, you can use this module in magisk itself.no need of kernel su

But also since this module is originally made for kernelsu it will also work in hiding zygisk there too.
[Magisk] HippoMan:
Good news indeed!
[Magisk] rushiranpise:
No, in simple terms it replaces original zygisk of magisk with the one used on kernel su (zygisk on kernelsu)

And does not install any kernelsu functionality.
[Magisk] ykjae:
I installed and shamiko isn't detecting zygist. So I have all 4 fails on play integrity. I also cannot see this as a fix since its still running the zygote process but telling magisk it's not.

TJW Magisk 26203
[Magisk] zgfg:
I cannot use LSPosed with this module - when opening LSPosed shortcut it pops out error

Not good for me:

LSPosed icon pops up error and it crashes when I press Cancel or OK, so I cannot anymore manage my LSosed and its modules (some modules do not have apks but they must be opened through LSPosed manager, that module, then Settings)

Even more terrifying, Play Integrity fails Basic and Device

And btw, Momo displays more findings (with normal Zygisk and with Shamiko it only finds Magisk, now also SU and Abnormal partitions)

My setup:

Xiaomi, A13

No KernelSU

Magisk Canary 26203

Zygisk disabled and Shamiko uninstalled, using instead that Zygisk module

Ofc, I'm reverting immediately to the normal setup now
[Magisk] shoey63:
Which version of USNF/Play Integrity Fix passes both DEVICE and BASIC_INTEGRITY with this method?

Or do you have to sacrifice Google Pay in order to get certain banking apps to work?
[Magisk] rushiranpise:
It will show as module is disabled due to no zygisk available in magisk app,but module should work in background.

What is your lsposed version? Mine is from ci v1.9.2 7029

Also, for me shamiko was not needed as i was passing those apps by default.

But the lsposed devs has updated shamiko can you try with it.

Note: zygisksu on magisk only supports whitelist mode. so create /data/adb/shamiko/whitelist for shamiko and reboot

Also Is gms in deny list?

I'm using Crdroid A13,it passes safteynet by default.So i dont use usnf/paly integrity
[Magisk] wyt18:
I think it would help all users here if we had a more comprehensive list of pre-requisites for this new KSU based module / approach to work

I tried it as well on Stock A12 One Ui S20 (stock kernel), Magisk Delta, no Shamkiko (didn't need it), USNF displax 2.4.0, Zygisk-Lsposed 1.9.2, HMA. Didn't work for me
[Magisk] rushiranpise:
I used it on both of my phones.

With Magisk Delta: A13 Crdroid, Safteynet was passed by default

With KernelSU(manual integrated): A12 OneUI 4.1,Safteynet was broken, so i used PlayIntegrity fix(deleted service.sh file from module folder as it caused detection in Native test app)
[Magisk] pndwal:
FWIW, fixes are coming constantly... Latest versions/changelogs (today's builds):

👀 PW
[Magisk] pndwal:
Personally, I find it simpler just to use WIP NB loaded Zygisk in Alpha fork ... I also generally wait for other's comments/tests, thus I've avoided updating to the last broken version. 🙃 PW
[Magisk] WhoIsJohnGalt1979:
Shamiko 0.7.4-188 is for magisk 26302+, fails to flash on alpha 26301 (i downgraded immediately after reading the chat comments you had posted).
[Magisk] rushiranpise:
I have updated my post will all info
[Magisk] zgfg:
Ofc I have GMS in DenyList. I tested both with Zygisk-LSPosed v1.9 1 and v1.9.2

Also both with Zygisk-on-KernelSU-v4-0.7.1-99-9051f59-release and Zygisk_on_KernelSU-v4-0.8.0(106)

With and without Shamiko

Etc

But as said, this thing completely breaks Play Integrity for me, in all combinations I tried (and also LSPosed mngr is not usable)

Since this is my daily driver phone, I use Google Wallets and I pay with my cards, Play Integrity is a MUST for me - hence I will stick with the Magisk v26302 built-in Zygisk (+Shamiko)

I have couple of e-banking/ID apps that I use and I successfully hide 'rpot' from them with standard Zygisk+Shaniko and HMA
[Magisk] rushiranpise:
Can you check my updated post? As the dev himself tested it with magisk alpha version .

If still not, i can't help anymore. as every device can have different issues with detections
[Magisk] pndwal:
Yup, I just discovered the same... TJW Magisk 26302 is ok for most it seems, broken in some respects... Alpha 26302 is largely broken due to Hiding internal mount points experiment...

Could try with TJW Magisk... Think I'll wait for new Alpha... Best solutions/Zygisk loading methods etc seem in state of flux ATM... More next post... 🙂 PW
[Magisk] pndwal:
Interesting your ZoKSU 4-0.7.1 used native bridge loading... Seems that's being abandoned for 'new loading mechanism' = fuse + ptrace now (4-0.8.0):

Replace native bridge with fuse + ptrace

Dr-TSNG committed 2 days ago

... Will check where LSP Metagisk is going with this... 😶 PW
[Magisk] zgfg:
As I said, I'm using Canary 26203 - not Magisk Alpha (and don't have interests in switching to Alpha). Seems, as the others reported, it does not work properly without Alpha or generally for most devices (I see the others similarly reported broken Play Integrity SafetyNet with this Zygisk-on-KernelSU)
[Magisk] rushiranpise:
Thanks I have reported to the dev
[Magisk] rushiranpise:
Reply from module dev.

For more help, create issues for this on module's github
[Magisk] martinez2018za:
Hello please help me Can i pass play intégrité in m'y xioami Android 13 with magisk delta
[Magisk] zgfg:
Of course. You may need to use Play Integrity Fix module - download and everything is in another XDA thread, pls shortly google for those keywords

But only Basic and Delta, not Strong Integrity (Strong only on the not-modded phone with locked Bootloader)
[Magisk] Nightf0x_007:
Tried this new zygisk in ksu method but zygisk wont run & module shows zygiskd has crashed

Magisk delta 26301
[Magisk] zgfg:
Btw, I have tested now yZygisk-On-KernelSU module instead of the built-in Zygisk:

on my 2nd phone, older Xiaomi.eu, MIUI 12.5, A11

with Magisk Delta 26301 (latest)

As you described:

Magisk app shows Zygisk No

Play Integrity and LSPosed show as they are deactivated since Zygisk is missing

But I still pass Basic and Device Integrity - hence PI Fix module must be working

Also, LSPosed shortcut opens LSPosed parasitic manager and I can manage the LSPosed modules - hence Zygisk-LSPosed is working

And I get the same results for all root detectors as if using built-in Zygisk (I didn't loose anything, but for now there is no gain/advantage with this method either)

Ie, on this phone, Zygisk-On-KernrlSU (without using KSU) successfully replaces the built-in Zygisk
[Magisk] HippoMan:
This is positive news!

I realize, of course, that you personally are not running all possible LSPosed modules. But based on your findings with this, do you think that it's fair to say that all LSPosed modules which work when the traditional Zygisk is in use are also likely to function when Zygisk-on-KSU is installed, instead?
[Magisk] rushiranpise:
What detections are you getting, can you post ss?
[Magisk] zgfg:
Standard, inevitable detections: Unlocked BL, Developer Options, ADB/USB Debugging

So eg, Minotour is Normal (no detections), TBChecker fully passing (except Strong Integrity), Ruru fully passing (except Dev options and ADB debugging), Momo detects Magisk (but not SU, Zygisk nor Zygotte) and unlocked BL and Debugging mode

Ofc, I also use HMA and I had exactly the same detections/passes with the built-in Zygisk, so absolutely no + or - now

Bit it seems that phone is booting more slowly (it's my old, second phone without SIM), and maybe even works more slow too - I'll check this evening and I will probably return to the normal, built-in Zygisk
[Magisk] rushiranpise:
Since the main purpose of the module is to hide zygisk detection, it wont help hiding Dev options and ADB debugging in Ruru,And BL Unlock and Debugging mode in momo

For the Magisk Found in momo detection,you can try the zip i attached.

I wonder how you passed zygisk detection with original zygisk , as for me with original zygisk Minotour app will show abnormal environment and found injection ( and also apps will detect zygisk eg yono,zain cash and living mandri.)

For the performance part of the phone ,i face no issue.

Again each phone can have different results .
[Magisk] zgfg:
As said, yes, I do pass Zygisk detection in Delta with the built-in Zygisk. And I always did

How', it has been discussed in Delta thread, so please search and find there.

Also in others related threads, like Magisk General thread. And I'm not alone

Btw, do not use LSPosed modules like InNotDeveloper or DevOptsHide - they will trigger you Zygisk detections.

And don't try to hide something from Momo or Minotour by HMA - again, it will cause just more mess

And for the other detectors you commented, ofc that they are not related to this module - I just answered BCS I was asked to list detectors I have

FYI, I also don't have Zygisk detection in Momo (only Magisk detector) with official Magisk Canary, again by using built-in Zygisk and Shamiko (for Delta, there is no need for Shamiko).

And all that has been also discussed in the General Magisk thread ( and I already posted a lot there, describing my setup in very details)

Btw, in the meantime I have returned back to the built-in Zygisk😁
[Magisk] phone_etix:
Hi folks I have read a whopping 50+ pages of this back to June last year. Appreciate pndwal and rushiranpise posting about that notorious south east Asian city state identity app (singpas s). Honestly should be one of the benchmark tests for root detection, that bastard app that I have no choice but to use...

I want to give it a last try on my rooted phone, the issue I have is the app immediately force closes after opening, rather than even saying it's detected root.

Here are my settings

Spoiler content hidden.

Spoiler content hidden.

Question 1: I'm wondering if SP force closing is because I've blocked the wrong thing on denylist or HMA? Or if that's another common way apps respond to detecting root? Is anyone else using TJW Magisk + USNF Displax + shamiko + HMA getting SP force closing rather than showing a root detection page?

Question 2: it seems like one of the possible fixes is using Zygisk-on-KernelSU (now called Zygisk Next) I can't use kernelsu as my kernel (4.4.302-perf+) isn't officially supported and I don't want to risk compiling anything at all when I have no idea what I'm doing.

Previous posts suggest you can use this module without KernelSU... But the official github page says under requirements that there is a minimal KernelSU version (10940). **Which is it**? It seems like you need kernelsu? Or at the very least a kernelsu compatible kernel

Question 3: so is the only other confirmed alternative to get SP to work Magisk Alpha latest + shamiko latest (presumably has native bridge Zygisk?) Anyone else tried?
[Magisk] J.Michael:
@phone_etix Have you tried reverting your phone (reinstall unpatched LOS) to confirm that this miserable app will ever run on a modifiable (unlocked bootloader) device running a custom ROM?
[Magisk] Spartacus500:
How to fix this update 🤔
[Magisk] Nergal di Cuthah:
First question, what version (fork?) of magisk do you use
[Magisk] Spartacus500:
Magisk 26.3 stable & try update Shamiko new version & failed update
[Magisk] Nergal di Cuthah:
I think you need latest canary (26302)
[Magisk] Spartacus500:
In fact, I didn't notice that the version of Magisk I had was too low. Oh well, I have to wait for the new version of Magisk.
[Magisk] J.Michael:
The error message says install v26.3+. Since it also says 26302+ I don't know whether that means you will find a version labelled "26302+", or it just means "26302 isn't good enough, wait for an update". My first guess would be there is a version labelled "26302+". Finding it is left as an exercise for the reader.
[Magisk] zgfg:
26302+ should mean 26302 or higher

There is no such thing as Magisk official/Delta/Alpha "26302+".

But there are versions 26302, 26301, etc
[Magisk] Nergal di Cuthah:
Latest canary is 26302

Questioner only had stable (26300 i believe )
[Magisk] phone_etix:
I think out of curiosity I gave it a try before I flashed magisk but iirc it detected an unlocked BL/custom ROM. And a custom ROM is the only option to keep this old device receiving security updates - so ironically I need root in order to be secure?!

I had the same experience with Google Wallet. I think custom ROM (or at least LOS) = needs root these days whether you like it or not it seems 🙃 needs some way of spoofing the fingerprint

E: it seems like OP5 is one of the few phones where you could theoretically lock the bootloader after flashing a custom ROM but I'd rather avoid this for so many reasons
[Magisk] J.Michael:
There would be something satisfying about people using old, but originally approved, systems, not getting "security updates", to satisfy the banks' lack of understanding of what they are doing. Satisfying for me, not so much for the poor bastard whose phone gets hacked because he was keeping his bank happy.

I think you also have a good instinct in not re-locking your bootloader. When it doesn't go gracefully it could make it hard to recover from the brick-like result.
[Magisk] zgfg:
Fine, but he could also have Canary 36302
[Magisk] phone_etix:
That's what I was doing for the longest time (well also out of sheer laziness because resurrection remix abandoned ROMs for OP5 ages ago). But then the apps increasingly refuse to work on old OSes. I for one intend to try and use this reliable phone until the hardware irreversibly craps out. (Or there is no choice but to use kernelsu if you want root to block ads).

Anyway, back to the original post, has anyone been able to try Zygisk-on-KernelSU/Zygisk Next without kernelsu at all and still have success? It seems like you need kernelsu.
[Magisk] J.Michael:
I thought there were some posts about success using a Magisk module with a name like "on-KernelSU" without using the KSU kernel.
[Magisk] malcolmy:
I used Zygisk-on-Kernelsu with both Magisk Alpha and Kernelsu. It works just fine with both. Even Shamiko works with Kernelsu. LSPosed works. Some magisk modules will work on Kernelsu and some won't.
[Magisk] pndwal:
KernelSU is from weishu / tiann (TaiChi XPosed, Epic etc)... It's an alternative to Magisk root but lacks an inbuilt hooking framework...

ZygiskonKernelSU, now ZygiskNext, is from Nullptr / Dr-TSNG (Hide-My-Applist, NativeDetector, ApplistDetector etc)... It was originally designed to add Zygisk hooking (allow behavior of Zygisk API) to KernelSU, then from v4-0.6.0 (in March) support for Magisk root was added... The name has only just been changed to reflect the fact that it's not a KernelSU exclusive module...

ZygiskNext worked ok for me with Alpha Magisk fork, but at the time I tried it broke LSPosed Manager functions... I've reverted to Alpha's inbuilt Zygisk based on Metagisk native bridge loading implementation which is working better for me ATM...

Of course his may change, and interestingly ZygiskonKernelSU/ZygiskNext, which was also using native bridge loading, has just adopted a 'new loading mechanism', ie. fuse+ptrace (4-0.8.0)... It's very early days for these alternative hooking/injection methods and who can say whether native bridge, fuse+ptrace or some other Zygisk loading mechanism will ultimately prove superior?...

👀 PW
[Magisk] JME HILLS:
For this update to work you will need Magisk 26.3 26302 - which is the Canary version. I'm personally waiting for the next official Magisk update.
[Magisk] skyraven83:
me 2.

I have a feeling that maybe with this update + latest Shamiko the ebanking app I use (PostFinance) won't detect root anymore.