yashsingh1/xdaforums huggingface dataset:
[Magisk] spinning_quirK:
My point is that I need to use Shamiko to mask from Singpass and Citibank apps although the dev of Delta says Shamiko is useless.

Delta MagiskHide does not mask.

If Zygisk is disabled, the problematic apps work, but attestation fails (though failure still allows the problematic root-detecting apps to work).

I've used Riru before on vanilla Magisk, trying to hide bootloader unlock and etc, but Magisk was getting detected.

Thankfully Shamiko is not causing any issues on my phone, works well with Delta so far.
[Magisk] zgfg:
I asked you something that was related to your original question/statement "With Zygisk disabled, unable to pass BASIC attestation and the Safetynet / PlayIntegrity Fix modules do not work..."

You didn't answer... And now, reading both your posts, I don't know anymore are you talking/asking about Zygisk (again, it is needed for USNF/PI Fix module to pass SN/PI API) or about Shamiko (it is needed to hide Zygisk), or you mix one with another

Anyway, never mind, good luck
[Magisk] zgfg:
All below
[Magisk] pndwal:
Ah, so he's changed function naming convention from type to method even in list itself; see what you mean... Still, hide is correct function type (as it's proper root hiding type, not modification denial type)...

But might get attention... PW
[Magisk] spinning_quirK:
The answer is in the very statement that you thought you had to ask the question of, in my initial post.

https://xdaforums.com/t/discussion-...third-party-magisk-fork.4460555/post-88880611

"With Zygisk disabled, unable to pass BASIC attestation and the Safetynet / PlayIntegrity Fix modules do not work."

I found out that they do not work. Ergo, if I were not using them, I would not have found out if they worked or not.

And honestly, irrelevant question, since the point of my post is to enquire about why Shamiko is deemed not useful in Delta when I've found it to be otherwise. Thank you for trying to help.
[Magisk] intel_core_i7:
The statement was probably for delta v25, not v26.1. The owner also seems to stop being too sensitive and then ban someone on Telegram if someone mentioned Shamiko
[Magisk] Lu5ck:
If I am not mistaken, shamiko is made with intention to work with the official magisk, tested on magisk alpha initially which does experimental things. Official magisk run by topjohnwu has conflict of interest due to him working at google so he can't be involved with official magisk hiding root. It is also why magiskhide is removed.

Delta on other hand is trying to approach rooting differently, ultimately not requiring shamiko. Of course, shamiko still work on it because it pull commits from official magisk which include commits from alpha, alpha devs are big contributors to official magisk.
[Magisk] Stillhard:
Source: github
[Magisk] mGforCe:
Hello Folks, just updated to latest Magisk Delta - Canary build (26105)

I have enabled:

Zygisk

Bootloop Protection

Unmount modules

Unmount modules by default

Under Configure Mount (select the processes to be mounted) have following doubt : do I need to select Xposed modules too? Or just those apps, which need root access eg. AccA, FKM etc?
[Magisk] westruk:
If the module requires root, you need to add it to the unmount list
[Magisk] zgfg:
Screenshots attached

ATM latest Delta 56105, 0bb64ac4

Zigisk and Unmount modules list enabled

Magisk modules: Shamiko, Play Integrity Fix, Zygisk-LSPosed (and more)

LSPosed modules: HMA, Bootloop Spoofer (and more)

Fully passing:

- Play Integrity (Basic and Device) / SafetyNet with CTS Evaluation type Basic

- TBChecker

- S-Check

- Oprek Detector

- Ruru and Applist Detector

- Native Detector and Native Test

- both versions of RootBeer

- Key Attestation shows BL locked

More about in Magisk General thread, post #56770:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-88878595

and subsequent posts there #56772, #56781, #56782

Some facts to understand:

- To hide SN/Play Integrity with unlocked BL (and possibly custom ROM) you NEED (if not integrated to the custom ROM) USNF/Play Integrity Fix module

- I use PI Fix module, it is Zygisk module, as that it REQUIRES Zygisk (otherwise, it will not work and won't pass)

- Once you enable Zygisk, Zygisk becomes detectable and you MUST install Shamiko to hide Zygisk

- Having Zygisk, I can install then Zygisk LSPosed and its modules as above, providing to spoof/hide from additional detectors as listed above

Alternatively:

- if you don't want Shamiko, then you should not enable Zygisk (otherwise, SN/PI will fail detecting Zygisk, also TBChecker, Native Test and others will fail detecting Zygisk)

- In that case you must use Riru and install the RIRU version of USNF module from Displax instead

- Riru and Zigisk are not compatible

- Zigysk version of USNF will not work with Riru and Riru USNF will not work with Zygisk

- There is also Riru-LSPosed (that works with Riru but not Zygisk) and then you can also use LSPosed modules

Zygisk is supported by Delta, it has a switch to turn it on (for those who want/need), hence it is 'legit' to use.

It is not all about Delta but also about additional factors (need and use of PI Fix).

As explained above, Zygisk is detectable and it requires then Shamiko to hide it.

As you see, I use both of them on Delta and with no problems
[Magisk] westruk:
Shamiko doesn't hide Zygisk well
[Magisk] pndwal:
I haven't installed (yet) and am going by screenshots here:

https://xdaforums.com/t/...third-party-magisk-fork.4460555/post-88877853

...The Unmount modules section in Settings might be a bit confusing, but as I understand it users don't enter root apps in Configure Unmount here...

Edit:

I spoke to soon and haven't understood this hiding method it seems... See following post...

Will revise this post soon. Thanks @spida_singh 👍

👀 PW

Edit 2: see here:

https://xdaforums.com/t/discussion-...third-party-magisk-fork.4460555/post-88885537
[Magisk] spida_singh:
I can confirm, you only need to add apps that REQUIRE ROOT to the configure mount list.

I use the deliveroo rider app, when included in the list, it trips and finds root, when removed, it didnt.

So this acts as the old SU List (as it was named before) therefore you only need to check apps that require root in this list.

Also tested with Droidify app
[Magisk] pndwal:
Well current TJW Magisk cannot be properly hidden... WIP native bridge loaded Zygisk (an early POC form of which is also used by Delta) is much more hidable as it's memory is anonymous... Nb. native bridge loading for Rikka's Riru (introduced by @canyie) was the basis for it's inbuilt RiruHide and remained undetectable for some time, however banks have now developed ways to detect both NB loaded Riru and WIP NB loaded Zygisk...

The fact is that while Shamiko doesn't yet hide Zygisk fully, NB-Zygisk it can be hidden from most banks that detect current TJW Zygisk ATM using Shamiko... An exception (and one to watch) is Starling Bank... But Shamiko is currently the best Zygisk hiding we've got, and Riru cannot be hidden any better now that NB-Zygisk has entered the arena.

Nb. NB loaded Zygisk is a WIP and still not stable enough for TJW Magisk (conflicts still need resolving) and Shamiko/NB-Zygisk support is still a baby... Both the NB loading concept (Canyie discovered it was an ideal method although mainly used with different instruction sets such as x86 devices running arm apps but generally turned off on arm devices) and Shamiko are @canyies's however (with original hiding method in Riru from Haruue Icymoon), so no doubt we'll see further improvements after NB-Zygisk's official debut from Canyie, Shana and the rest of the LSP (incl. primary Magisk collaborators) team.

👀 PW
[Magisk] pndwal:
Ah! 🤦‍♂️... Thanks for the bucket of ice water!... I'm way behind then...

If this is SU list based hiding I'd better research and revise my understanding/what I wrote above... Thanks for putting me straight! 🙃 PW
[Magisk] spida_singh:
Also, i tested starling, on the latest Alpha without Shamiko (i dont use Zygisk and use the Riru version of displax mode) i would see the countdown trigger when openeing or closing the app, now i dont, I had two days remaing, so i will check to see if it trips / stops working, it will then hopefully provide assurance that the latest delta works better in my use case, i have a feeling if i enabled Zygisk it would trip base don hiding with Shamiko as described.

If it runs, then for 'my' use case.

I can achieve root, lsposed, avoid my apps from detecting root and pass PI (BASIC and DEVICE) using delta and the Riru version of the displax USNF module.

Pixel 6

LineageOS 20

Riru

LSposed Riru (latest github action build)

Magisk Delta - app-release.apk

safetynet-fix-v2.4.0-MOD_1.3-Riru.zip

I will keep you posted :)
[Magisk] chowfun:
Interestingly, on LineageOS 19.1 and on my Pixel 4a 5g with the latest Delta Canary version installed, taking a screenshot will cause SystemUI to crash if MagiskHide Whitelist is turned on. The only way to get around the issue is by turning the whitelist off, or by editing the magisk.db file to add the com.android.systemui UID into the policies table and set the policy value to a 2 (which essentially allows SystemUI with root access).

It also appears that turning the whitelist on will also prevent the Hide Magisk app function from working with the new hidden app complaining that root is lost and will revert the changes.
[Magisk] zgfg:
I would never use Whitelist for MagiskHide

If I install a 'banking' app, I would add it to my list immediately and only thereafter I would open that app for the first time

If it happens that some app (that I overlooked to include to my list) detects 'root', I wiould then include it to my list but also wipe the app's cache and data before retesting

Ie, I don't see a point in the whole concept and use of MagiskHide Whitelist (unlesst if asking for a trouble) and I specially don't understand users who would want to use it 😁

But of course, everybody is free to experiment
[Magisk] chowfun:
The reason why I use it is because there are apps out there (e.g. PayPal) that tracks your root status covertly but doesn't give you any special indications in the app. It then sends that information to the server and goes into some kind of risk assessment of what kind of naughty things you are up to...
[Magisk] zgfg:
That's what I said but maybe did not express clearly enough or you did not decode from my words

Every app that smells of payments or similar ('banking' apps do not mean they must be for a particular bank), I would include to my MagiskHide or DenyList (depending on the sort of Magisk I use at the moment or on that phone), before opening that app for the first time

Also for games - however, I don't play them hence I don't need to care about

Eg, I fortunately also thought of in advance and applied DenyList/MagiskHide to a VPN authentication app we use at work - if I did not, I would have troubles witth security specialists from our IT dept

However, I would never blindly apply MagiskHide Whitelist (IMHO, a lazyman option), thus risking to break some system's functionality
[Magisk] zgfg:
I'm on Delta Canary 25201 and SafetyNet still works with no issues for me
[Magisk] huskydg:
If you don't use any modules related to theme such as font, overlay,... Whitelist won't cause any problem
[Magisk] chowfun:
The only modules I have are App systemizer, fullscreen/immersive gestures, magiskhide props, systemless hosts and universal safetynet fix.

Nothing specific to themes...
[Magisk] huskydg:
Zygisk Pixelify ported to Riru module

GitHub - HuskyDG/Riru-Pixelify: Riru version of Pixelify

Riru version of Pixelify. Contribute to HuskyDG/Riru-Pixelify development by creating an account on GitHub.

github.com
[Magisk] citroene:
Hi, i have a samsung galaxy S10+ with stock rom rooted with magisk 25.2 and using ambassadi kernel with build in magisk.

Is it possible to use magisk delta in this situation?
[Magisk] bc Yume:
I guess it is caused by the new changes made to Play Integrity API that break some banking apps. It just so happened to take place around the same time Magisk 25.2 was introduced.
[Magisk] zgfg:
SafetyNet by itself still continued to work (it's the same SN checking as it was a week, month or so ago)

Changes are related to Wallet that depends on the new Play Integrity API

Nevertheless, you are quoting my post from Saturday - in this Internet time it is like from a medieval history 😁 - since then (on that phone) I installed USNF 2.3.2 to get it passing PI API, MEETS_DEVICE_INTEGRITY
[Magisk] m0han:
A quick search took me here and the latest release is 2.3.1. Please share the link to 2.3.2. Or, did you support development for early access to updates?
[Magisk] zgfg:
Read what's going on in GPay thread and/or USNF thread, what Displax released there since the last weeken in the posts

His latest from yesterday was safetynet-fix-v2.3.1-MOD.zip
[Magisk] m0han:
safetynet-fix-v2.3.1-MOD.zip

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-3-1.4217823/post-87198517

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-3-1.4217823/post-87207303
[Magisk] huskydg:
Riru version

GitHub - HuskyDG/safetynet-integrity-fix: A workarround to pass SafetyNet / Play Integrity API on rooted devices with unlocked bootloader

A workarround to pass SafetyNet / Play Integrity API on rooted devices with unlocked bootloader - GitHub - HuskyDG/safetynet-integrity-fix: A workarround to pass SafetyNet / Play Integrity API on r...

github.com
[Magisk] huskydg:
Thread re-opened
[Magisk] m0han:
Will we get the 'old' UI in the next release of Magisk Delta or will it be OneUI?
[Magisk] huskydg:
Reverted in latest
[Magisk] m0han:
Magisk Delta 'old' UI back. Update button is clearly noticeable. This is fine.
[Magisk] Vision:
I download both magisk delta and canary I install in nox emulator 7.0.3.2 android 9 but when try open the app just close it and delete it itself
[Magisk] mGforCe:
Yes, this is the way! I also tested same.

In my use case, I need to add the app to Mount List, as I have enabled " Unmount modules by default". So no Unmount List, rather Mount List

No worries, nevertheless appreciate taking time to write the reply and then correcting it.
[Magisk] mGforCe:
Getting confidence from your post, I also went ahead and installed latest Magisk Delta v26 56105, 0bb64ac4 on my daily driver (Nothing Phone 1)

Few questions:

For all these detectors / checkers - you have added them to Unmount List etc right?

Also added them to HMA to hide the apps like Xposed modules right?

Reason am asking is that without Shamiko also, previously on Magisk Delta (last v25) with MagiskHide, these detectors worked well for me - no flags raised.

Hence wondering, with Magisk Delta v26 (with MagiskHide gone), is Shamiko needed. Or Unmount List is sufficient?

NB: One new issue for me is Xposed Hooks being detected byApplist Detector/Ruru, TBChecker etc.

Not sure if I changed something in between my setup (I didn't check these detectors today on my base setup before jumping to Magisk v26 latest build) but as far as I remember Xposed Hooks was never an issue in my base setup (there was only one issue XprivacyLua being detected and this is a known thing).

Do you also see Xposed Hooks?
[Magisk] pndwal:
So per his TG:

- MagiskHide and SuList has been replaced by "Unmount modules". The name is changed to [give the] correct mean[ing] but [the] functionality is remained

It is apparent that:

• Unmount modules, which allows Magisk to unmount modules for selected apps, is MagiskHide in whitelist mode (like vvb2060's Lite and recent HuskyDG Delta w/ sulist), ie Magisk is hidden by default with only process in Configure unmount list able to explore/gain Magisk root privilege.

• Unmount modules globally by default, which allows Magisk modules to be unmounted globally and mounted for selected apps, is MagiskHide in blacklist mode (like traditional TJW MagiskHide), ie Magisk is hidden only for process in Configure mount list.

Please could a user say how home menu Superuser configuration is used... Is the list substantially the same as Delta's Configure unmount list (ie duplicated), or is it not used in simple Unmount modules mode?

👍 PW

...I'm wrong again... 😂
[Magisk] mGforCe:
I think there is a correction needed here.

Unmount modules --> it is just a toggle to enable unmount

Unmount modules by default --> when toggled on, it means Magisk in whitelist mode. Hence by default Magisk is unmounted = not available for access

Post this, one needs to reboot as per app and then we see

Configure Mount wherein one has to Select the processes to be mounted ( Select apps where one want Magisk available). Only once we have selected app here, can they seek Superuser access and be seen in Superuser tab.

If I un-select an app, which has Superuser granted, from Configure Mount, it will cease root access.

Some snaps for reference. Superuser window is same as prior.
[Magisk] Nicols0Mart:
I think you got it all the way around, "Unmount modules" is old MagiskHide and "Unmount modules globally by default" enables old SuList (ie. MagiskHide in whitelist mode).

As far as I know these are just renamed configurations in Magisk Delta manager app, but functionality is the same as before (Correct me if I'm wrong).

As far as Superuser configuration in home menu, I think it still behaves as before (at least with "Unmount modules globally by default" disabled it is, maybe someone who used old SuList can confirm if it's still the same)
[Magisk] pndwal:
Ah... 😂

Think I've got it now... Missed that @spida_singh had said put root apps in Mount list, not Unmount list... 😬

So...

So per his TG:

- MagiskHide and SuList has been replaced by "Unmount modules". The name is changed to [give the] correct mean[ing] but [the] functionality is remained,

• Unmount modules, which allows Magisk to unmount modules for selected apps, is MagiskHide in blacklist mode (like traditional TJW MagiskHide), ie Magisk is hidden only for processes in Configure uunmount list.

• Unmount modules globally by default, which allows Magisk modules to be unmounted globally and mounted for selected apps, is MagiskHide in whitelist mode (like vvb2060's Lite and recent HuskyDG Delta w/ sulist), ie Magisk is hidden by default with only processes in Configure mount list able to explore/gain Magisk root privilege.

Please say if I'm still missing something... And thanks for details re. Interaction with superuser list... 👍 PW
[Magisk] mGforCe:
unmount needs to be changed to mount.
[Magisk] mGforCe:
You are there :)

If we toggle on "Unmount modules globally by default" then post reboot option below is seen as Configure Mount

If we toggle off "Unmount modules globally by default" then the option below is seen as Configure Unmount
[Magisk] pndwal:
Fixed again!... 👍 PW
[Magisk] zgfg:
Generally, as a rule of thumb:

Put every checker and each banking app into DenyList/MagiskHide/UnmountModules list

Also, use Hide My Applist (HMA) and hide all LSPosed modules plus the Magisk app from them by HMA

And reboot

Do that before you run those apps for the first time. Or wipe their data and retest them after you configure as above

However, some apps do not require both:

Eg, Native Test/Detector does not look for apps and they need only DenyList/MagiskHide/UnmountModules part

To the other side, Applist Detector looks only for LSPosed modules hence you need only the HMA part

KeyAttestation app does not need one nor another but only Bootloader Spoofer (LSPosed module - I think, you can find it on GitHub, it was also posted/attached in one of the USNF threads here)

For HMA, there is a thread on XDA - look at its OP post #1 and follow the link to GitHub HowTo Guide

If you use whitelist mode for Unmount Modules, then it's easier for that part, every newly installed banking app and detector will be automatically enabled for Unmount Modules
[Magisk] spida_singh:
Spoke to soon. It tripped following today's delta update. But not sure why.. o well. 😁
[Magisk] pndwal:
If they detect NB loaded Zygisk injection, they're bound to be detecting Riru injection which is essentially the same beast. See here:

https://xdaforums.com/t/discussion-...third-party-magisk-fork.4460555/post-88884165

... However RiruHide (inbuilt) won't improve since it's deprecated... Hopefully Shamiko/NB-Zygisk support/symbiosis will continue to improve. 🙃 PW
[Magisk] zgfg:
Follow-up:

I retested now on the same phone, same Delta version, same set-up except that I DISABLED Shamiko now:

- Still passing Device and Basic Integrity as with Shamiko

- Momo looks even better now, it doesn't detect Zygisk like with Shamiko

- Only Native Test (Minotaur) reports Injection again (with Shamiko it says Normal - no Injection)

- all other detectors pass exactly the same as above (incl all green for the most powerful TBChecker)

Hence maybe Shamiko is really not needed with Delta. Depending on are you more concerned with what Momo reports or what Minotaur reports - in other words, worth to try both options with a real banking app that still detects root

---

Btw, I found now also that I can suppress Magisk Detected in Momo if I disable the Systenless Debloater module (it's strange bcs my module simply mounts a dummy APK file over the debloated system apps)

Hence I can nail Momo down to as on the screenshot - No modifications but something suspicious...

And Memory Detector is actually clean - it detects only that the patched YT and YT Music Revanced apks are mounted over the official ones
[Magisk] zgfg:
If I checkmark Momo for Bootloader Spoofer, then Momo no more reports that Bootloader was unlocked but it reports then again that Zygisk was detected, and now even more that Zygote is injected and that XPosed hooks are found (and I don't see any way to suppress with HMA - enabling Momo in HMA causes Momo even worse to report that Services were not started) - maybe @chiteroman / @sher4581 could check
[Magisk] m0han:
I've just now updated to Magisk Delta Canary d2a66567 and things seem fine. No Xposed Hooks detection.

Spoiler content hidden.

Xiaomi Poco X3 karna

AICP A12.1 17-March-2023

Riru v26.1.7.r534.4c4695c65f

Riru-LSposed v1.8.6 (6968)

Magisk Delta Canary d2a66567

SafetyNet-Fix-v2.4.0-MOD_1.3-Riru.zip
[Magisk] m0han:
Memory Detector is fully clean. M0M0 detects 2 modifications. Although not important, would like to figure out how to remove those two. :D

Yes, same was the case with me. So removed Bootloader Spoofer. (y)
[Magisk] huskydg:
Some ROMs such as CrDroid, some maintainer has added bootloader spoofer.
[Magisk] zgfg:
Actually, I was referring to something that 'locks' Bootloader but not for Play Integrity/SafetyNet but for apps like Key Attestation:

GitHub - chiteroman/BootloaderSpoofer: Spoof locked bootloader on local attestations

Spoof locked bootloader on local attestations. Contribute to chiteroman/BootloaderSpoofer development by creating an account on GitHub.

github.com

Release v1.6.0 · vvb2060/KeyAttestation

Contribute to vvb2060/KeyAttestation development by creating an account on GitHub.

github.com
[Magisk] chiteroman:
Is there any public source code to check how they implemented it? Because modifying conscrypt library isn't enough, they must use Pine (or smth else) to hook Java classes in memory.
[Magisk] chiteroman:
Best way is modifying framework.jar and implement hook using Pine, so Momo won't detect it.
[Magisk] Bkblues:
How to do it? Is there a more detailed explanation? Thank you!
[Magisk] Lord Sithek:
Hi everybody. I gave a shot to the latest stable Magisk Delta (26.1) on my Xiaomi Mi Note 10 with MIUI ROM. It looks like when I enable SuList along with both USFN or PlayIntegrity Fix modules flashed, I can't open Play Store and some other Google apps or I can't log in to them. It works fine with MagiskHide, just has issues with SuList enabled. Anybody noticed something similar? Of course I can provide logs if needed.

Currently I'm on EEA Global variant, but I observed the same behavior with Xiaomi.eu ROM
[Magisk] zgfg:
In the (latest) Delta (but I don't know of Delta Stable, I downloaded earlier from Telegram and I update through the app when notified of a new version) there is no more MagiskHide/SuList but Unmount modules List

Using Play Integrity Fix (with or without Shamiko), working fine fine for me