[ASUS ZenFone 8] bnsmb:
Update 29.01.2024

The denylist can also be changed using the parameter --denylist of the magisk executable:

Spoiler content hidden.

Magisk saves the settings for the DenyList in the database /data/adb/magisk.db. This is an SQLite database that can also be changed in a script with the executable magisk; the use of magisk for this purpose is:

magisk --sqlite SQL

where "SQL" is the SQL statement to execute. For example to list all tables in the Magisk database /data/adb/magisk.db use:

magisk --sqlite ' SELECT * FROM sqlite_master where type="table";'

e.g.

ASUS_I006D:/ # magisk --sqlite ' SELECT * FROM sqlite_master where type="table";'
name=policies|rootpage=3|sql=CREATE TABLE policies (uid INT, policy INT, until INT, logging INT, notification INT, PRIMARY KEY(uid))|tbl_name=policies|type=table
name=settings|rootpage=5|sql=CREATE TABLE settings (key TEXT, value INT, PRIMARY KEY(key))|tbl_name=settings|type=table
name=strings|rootpage=7|sql=CREATE TABLE strings (key TEXT, value TEXT, PRIMARY KEY(key))|tbl_name=strings|type=table
name=denylist|rootpage=9|sql=CREATE TABLE denylist (package_name TEXT, process TEXT, PRIMARY KEY(package_name, process))|tbl_name=denylist|type=table
ASUS_I006D:/ #

# or using the executable sqlite3 (see below)

1|ASUS_I006D:/ # sqlite3 -table /data/adb/magisk.db ' SELECT * FROM sqlite_master where type="table";'
+-------+----------+----------+----------+---------------------------------------------------------------------------------------------------------+
| type | name | tbl_name | rootpage | sql |
+-------+----------+----------+----------+---------------------------------------------------------------------------------------------------------+
| table | policies | policies | 3 | CREATE TABLE policies (uid INT, policy INT, until INT, logging INT, notification INT, PRIMARY KEY(uid)) |
| table | settings | settings | 5 | CREATE TABLE settings (key TEXT, value INT, PRIMARY KEY(key)) |
| table | strings | strings | 7 | CREATE TABLE strings (key TEXT, value TEXT, PRIMARY KEY(key)) |
| table | denylist | denylist | 9 | CREATE TABLE denylist (package_name TEXT, process TEXT, PRIMARY KEY(package_name, process)) |
+-------+----------+----------+----------+---------------------------------------------------------------------------------------------------------+
ASUS_I006D:/ #

Note:

All commands to read or change the file /data/adb/magisk.db must be executed as user root.

The SQL database used by the magisk executable is fixed and can not be changed.

See the Magisk documentation for more infos about the DenyList - this HowTo is only about how to configure the DenyList via CLI commands.

Prerequisites

In the current version of Magisk (v26.x) the feature zygisk must be enabled to use the DenyList.

To enable the zygisk feature from Magisk use:

magisk --sqlite 'insert into settings (key,value) values("zygisk","1");'

and reboot the phone.

Notes:

If the database entry for zygisk already exists with another value either delete and recreate it or use

magisk --sqlite 'replace into settings (key,value) values("zygisk","1");'

to change the value.

Use

magisk --sqlite 'select value from settings where (key="zygisk"); '

to read the current value for the setting, e.g.

ASUS_I006D:/ # magisk --sqlite 'select value from settings where (key="zygisk"); '
value=1
ASUS_I006D:/ #

Either delete the entry or change the value to "0" to disable the zygisk feature again.

A reboot between enabling zygisk and enabling the DenyList is not necessary.

Enable and configure the DenyList

To enable the DenyList from Magisk use:

magisk --sqlite 'insert into settings (key,value) values("denylist","1");'

and reboot the phone.

Notes:

If the database entry for the DenyList already exists with another value either delete and recreate it or change the value to "1" (see the description about the "zygisk" entry above for how to do that).

Disabling the DenyList will not delete the list of already configured entries in the DenyList (but they will be ignored if the DenyList is disabled).

To list the current entries in the DenyList use

magisk --sqlite 'select * from denylist'

e.g.

ASUS_I006D:/ # magisk --sqlite 'select * from denylist'
package_name=io.github.vvb2060.keyattestation|process=io.github.vvb2060.keyattestation
ASUS_I006D:/ #

To add an entry to the DenyList use

magisk --sqlite 'insert into denylist (package_name,process) values("com.mixplorer","com.mixplorer");'

and check the result:

ASUS_I006D:/ # magisk --sqlite 'select * from denylist ;
package_name=io.github.vvb2060.keyattestation|process=io.github.vvb2060.keyattestation
package_name=com.matoski.adbm|process=com.matoski.adbm
package_name=com.apk.editor|process=com.apk.editor
package_name=com.mixplorer|process=com.mixplorer
ASUS_I006D:/ #

To delete an entry from the DenyList use

magisk --sqlite 'delete from denylist where (package_name="com.apk.editor");'

To find the correct values for the entries in the DenyList use the command

pm list packages

e.g.:

ASUS_I006D:/ # pm list packages -f | grep gallery
package:/product/app/Gallery2/Gallery2.apk=com.android.gallery3d
package:/system/priv-app/AsusGallery/AsusGallery.apk=com.asus.gallery
ASUS_I006D:/ #

Or check the list of applications that can be added to the DenyList in the Magisk App:

View attachment 6050884

Note that you can also add entries for not installed apps into the DenyList.

A reboot is necessary after all changes for the table denylist are done to activate the changes (there might be a method to force Magisk to re-read the database without a reboot but I do not know how this can be done)

Notes:

All changes to the sql database for Magisk can also be done use the sqlite3 executable - e.g.:

# list the tables in the database
#
sqlite3 -table /data/adb/magisk.db ".tables"

# or

sqlite3 -table /data/adb/magisk.db ' SELECT * FROM sqlite_master where type="table";'

# list the entries in the DenyList
#
sqlite3 -table /data/adb/magisk.db "select * from denylist ;"

# add an entry to the DenyList
#
sqlite3 -table /data/adb/magisk.db 'INSERT INTO denylist (package_name,process) values("com.apk.editor","com.apk.editor");'

# delete an etry from the DenyList
#
sqlite3 -table /data/adb/magisk.db 'DELETE FROM denylist where (package_name="com.apk.editor");'

A sqlite3 binary for arm64 CPUs is available on my home page: https://bnsmb.de/files/public/Android/sqlite3

see Some hints for using Magisk on Android phones and How to enable root access using Magisk in a script for other usage hints for the Magisk database