yashsingh1/xdaforums huggingface dataset:
[Magisk] Wezyk123:
Could you make fingerprint work in this app?

Bank Millennium – Aplikacje w Google Play

Zarządzaj finansami na Twoich zasadach

play.google.com
[Magisk] hopeeeeee09:
Yes, maybe HyperCeiler is the problem
[Magisk] snake-4:
Oops, I just found out and fixed the reason why ReVanced was getting detected.

It should work fine on the next release but I will try to add some other features before the next release, so if you don't want to wait you can use the latest CI build.
[Magisk] hopeeeeee09:
Nice, tks u so much for this module, is so great !!!
[Magisk] kodein:
I won't pass the play integrity check if I use ZA...

I use APatch, zygisk next 1.0.4, PIF 15.9.7...

Without ZA, the integrity check will pass
[Magisk] Captain_Throwback:
Do you have DenyList enforced in Zygisk Next? If so, you need to disable it.
[Magisk] kodein:
Yes. Disable it
[Magisk] user2k10:
Where can I download the latest CI build?
[Magisk] sawdoctor:
GitHub

Workflow runs · snake-4/Zygisk-Assistant

A Zygisk module to hide root for KernelSU, Magisk and APatch, designed to work on Android 5.0 and above. - Workflow runs · snake-4/Zygisk-Assistant

github.com
[Magisk] user2k10:
Thanks
[Magisk] xxjoe08:
i am on apatch. installed zygisk assistant with deny list off, it hides zygost injection, zygisk which is good

however, it breaks bootloader spoofer and attestation/cts profile. disabled assistant and they resume normal
[Magisk] snake-4:
Try the latest CI build from the link above. I've just tested on my device with APatch and PIF is working fine.
[Magisk] kodein:
It still doesn't work for me... Installing the module and restarting, it ends with cheese in loops and the phone restarts....
[Magisk] hopeeeeee09:
when can u have new update for this module xD
[Magisk] Big Dumb Object:
In passing I discovered an comprehensive list of root detection tools, if anyone is interested.
[Magisk] hopeeeeee09:
Hi =((( this still available right :< no see dev reply
[Magisk] snake-4:
Yes. I just want to implement a new feature before a release but you can use the CI build for now.
[Magisk] hopeeeeee09:
tks, i will wait more xD, just scary u will drop this :(((
[Magisk] hopeeeeee09:
I just test this module to get my main language in original rom HyperOS, but it cannot hide root with u module :< so sad, do u have a solution to get hideroot in this module. Tks
[Magisk] snake-4:
I've published a new update v2.1.0. Could everyone who were having issues try it?

Your two apps also pass the root detection now on the latest version.

Ahh it has a system overlay. There is an open issue about that on the GitHub but latest version should hide root even with that. If any apps are unstable while using that module, please try to whitelist them.
[Magisk] kodein:
After installing and rebooting ZA (all versions), I usually close the ui system at short intervals until the phone finally turns itself off... It still doesn't work for me...

Sony xperia 10IV and APatch...
[Magisk] kodein:
So I found out that ZA is functional, (only if I have the ZNext, PlayIntegrity, LSposed modules), when I added other modules, I get to the system UI restart. I still don't see which module ZA is in conflict with...

EDIT: So ZA is in conflict with the Font Manager module (app) if I change the original fonts to some other ones

Then set the restart system UI

And if I have all the modules enabled, then with active ZA, the mobile will turn off into recovery after about 3-5 minutes
[Magisk] sawdoctor:
Just tested your new update and finally my 2 troublesome banking apps that have detected root for months are working again.

Thanks so much for your hard work and fixing this for us, greatly appreciated
[Magisk] hopeeeeee09:
Already update,tks u, but this app still check root dectection when I use that module system overlay that xD, already add in white list like u told, here is the app: https://play.google.com/store/apps/details?id=com.vnid&hl=en_US
[Magisk] gentano:
PAYBACK - Karte und Coupons – Apps bei Google Play

Noch mehr Punkte, exklusive Coupons und Rabatte. Jetzt sparen!

play.google.com

Payback App still detects root with ZA 2.1.0, switching back to Shamiko 1.0.1 and the app works. Enforce denylist is disabled in Magisk 27002 Alpha.
[Magisk] nadeemakhtar1994:
After updating to v2.1.0 play store application called 'TIDE BUSINESS INDIA' doesn't work anymore. It detects root on startup and force closes. Switched back to v2.0.4 and it works fine. So a bad release for me. Won't update untill issue is fixed.

Tide Business India - Apps on Google Play

Tide is a business financial platform that helps you start doing what you love.

play.google.com
[Magisk] Vanda Suavis:
Even after updating to the latest version, Securify still reports 'found a suspicious mount' (Revanced), and now, for some reason, it also detects zygisk, which was previously hidden.
[Magisk] snake-4:
This doesn't happen on AVD or my devices. Can you check if you're using the latest Magisk version? Also, please share details about your device and Android version, and list your Magisk modules.

Whitelisting the app will obviously make it detect root. Modules that have framework overlays are not supported yet, I'll try to fix them on the next release.

These two apps use the same type of "root" detection. It shouldn't be hard to add prop hiding but I didn't want to do it before because this is more like detection of the custom ROM and not the root itself. But of course if you have other modules that change props then they will be a detection vector unless I add prop hiding.
[Magisk] Vanda Suavis:
Sorry. i'm using KSU on the P6a A14.

Edit 1: the suspicious mount is now fixed. Zygisk however is still detectable.

Edit 2: enabling enforce denylist hides Zygisk, but breaks LSPosed.
[Magisk] shadowstep:
@snake-4 Thanks for this, been trying it out for the past week or so (whenever I got some time) for my finicky apps. For now, three stand out:

iMobile Pay

I've been able to hide root, but the app detects USB debugging and developer options. Any time I use an Xposed module (there are a few around) to prevent that, the app detects root (i.e. it is detecting when it has been hooked). The only workaround for now is to turn off both the options before opening it.

Citibank IN

Just like the one above, this one also detects USB debugging (maybe developer options too, but the toast it displays asks the user to turn off USB debugging). I tried hiding that using the same modules I tried for the one above, but they don't work, and the app still complains about USB debugging being enabled. It doesn't crash like the one above when a module is hooked into it.

IndianOil ONE

This one straight up refuses to work with my setup. Don't know what it's detecting. I've currently using an older version of this, with which my existing hiding worked.

Whenever you get the time, I'd appreciate if you could have a look. Thanks again!
[Magisk] gentano:
Maybe you can make prop hiding optional/a setting? But You are correct for the Payback App, it checks for custom rom (besides root). Would be great tho if You can add it!
[Magisk] amn1987:
The last (latest version) poses no issue in a device rooted with Kitsune (27001), Su List enabled. No Zygisk or LSPosed.

Besides the Payback Germany app didn't complain about root as well in the same setup(CrDroid A12).
[Magisk] snake-4:
Updated GitHub CI workflow... · snake-4/Zygisk-Assistant@2a31d65

A Zygisk module to hide root for KernelSU, Magisk and APatch, designed to work on Android 5.0 and above. - Updated GitHub CI workflow... · snake-4/Zygisk-Assistant@2a31d65

github.com

This build fixes LSPosed hiding. Though injected apps may still detect Xposed since it's difficult to hide when functions have been hooked.
[Magisk] Captain_Throwback:
So I just tried this build, and I'm noticing some differences between what is detected when using Zygisk Assistant versus Shamiko.

Here are some screenshots of the differences when using multiple detection apps. My setup is Android 14, running KernelSU, with Zygisk Next 1.0.5, LSPosed 1.9.2 (7058).

The LSPosed detection seems to be related to what thr Hunter app reports with the dex2oat loop mounts, which also seems to be what Native Test reports as "Conventional Tests (2)".

If you'd like me to grab a log from the debug version of the module, just let me know exactly what to pull and I'll gladly oblige.
[Magisk] Vanda Suavis:
Just flashed this build. LSPosed is now active, but modules are still not working. I thought giving them root access would fix the problem but no luck.
[Magisk] shadowstep:
What app are you talking about? iMobile? It works fine for me as long as USB debugging and developer options are turned off. I was just looking for a way to hide those two from the app so that it works even with them on.

No dice. Thanks for your effort nonetheless! :)
[Magisk] amn1987:
Indian Oil One.
[Magisk] snake-4:
Ah I see the problem. Because mountinfo paths are relative to their device, they don't start with /adb/ on KSU, cause KSU loop mounts the /data/adb/modules. I can probably add an extra check to unmount by st_dev on KSU. I should really write a test suite because there are a lot of different configurations where things like this differ.
[Magisk] shadowstep:
Oh, cool. Thanks! Can you check if it works with Zygisk enabled? Maybe it's detecting Zygisk? If it is, I'll try switching to Zygisk Next first. If that still doesn't work, then I'll shift to Kitsune.
[Magisk] amn1987:
No issues after enabling Zygisk. Reportedly the built-in Zygisk in Kitsune is pretty similar to Zygisk Next so no need to install the latter.
[Magisk] AragonX:
Just in case will prove interesting this app has a months old zygisk detection that is still good against the latest ZA.

It's actually zygisk that's detecting not any of the modules.

neo bt - Android Apps on Google Play

Enjoy millions of the latest Android apps, games, music, movies, TV, books, magazines & more. Anytime, anywhere, across your devices.

play.google.com

Using Magisk Alpha 27002 on A12, PI passing no conflicts

And just to confirm ZA is actually working on my phone the other bank I'm using has 2 apps that are working just as well with ZA or Shamiko (or both). Thanks for the module, I already disabled shamiko...
[Magisk] shadowstep:
Thanks! Switched to Zygisk Next and now the latest version works like a charm. (y)
[Magisk] Captain_Throwback:
The same would probably go for APatch, since it also uses a modules.img.
[Magisk] Captain_Throwback:
Latest CI build seems to be hiding everything as expected on both KernelSU and APatch (for me, at least). Thanks for the quick update!
[Magisk] sukdev_bansal:
I have installed yt revanced magisk module after installing yours yt keeps crashing
[Magisk] snake-4:
Make sure "Unmount modules" is disabled for YouTube.
[Magisk] amn1987:
It seems it's not possible to get Pockets by ICICI Bank app to work in the Mainland in non-KSU/APatch devices. Only works under Work Profile. I clean flashed the ROM in my lone MSU device, didn't flash Magisk but Pockets still complained about root.

Device Integrity doesn't pass out of the box since some months. Can the same not be detected in Work Profile?

It would be hugely convenient if it could be found which device parameter Pockets app is recording. Destroying and re-creating the Island is easy but having to clean flash the ROM multiple times makes experimenting cumbersome.
[Magisk] snake-4:
It checks for the existence of Magisk manager and HMA hooks. It does this by querying for launcher intents as if it's a launcher and then parses the AndroidManifest.xml of the apps returned.

Why did Google allow this? I don't know, but it's out of the scope of this module to hide apps. Maybe try asking HMA devs?
[Magisk] amn1987:
HMA and/or LSPosed pose issues in case of several other apps so I had stopped using them in my non-KSU devices (and later even in them).

Since the device wasn't rooted so is the app checking for an unlocked bootloader? DI as mentioned earlier is broken. But it does work in Work Profile at least. I will use the other account in a KSU device under Island.

Google allows way too much freedom to apps. I had read that starting from last August apps targeting API 33? won't be allow to access the list of installed apps but that doesn't seem to be the case?
[Magisk] snake-4:
I said that. Google did restrict package visibility so apps now have to specifically request if they want to check for other apps. None of the banking apps I use seem to have this permission so it's kind of working as intended. However, some apps like launchers need a list of apps to function, so they are made an exception for.

In theory, Google only grants it to antivirus and launcher apps, but Pockets apps somehow got this permission, which I'm not exactly sure how.
[Magisk] alptangal:
can you try pass this app?

https://play.google.com/store/apps/details?id=com.mbmobile&hl=en_US

i follow your module but i still can't find solution to pass root check
[Magisk] CrabShell_U:
Thanks! It worked on my Xperia 1V for hiding root from Apple music after its recent update
[Magisk] snake-4:
It checks for native bridge Zygisk, so it would work with Zygisk Next (or Kitsune for that matter). If I had to guess, I'd say it's checking the native bridge prop but I haven't looked into it myself yet.
[Magisk] alptangal:
my device is s7 edge sm-g935f, my device rooted by magisk, Zygisk Next will work? because Zygisk need turn off Zygisk in magisk
[Magisk] alptangal:
i used kitsune mask with no result, still detected by banking app

tried turn on/off zygisk both but no result
[Magisk] Spartacus500:
What Rom do you have installed on your S7 Edge ?
[Magisk] alptangal:
I flash stock rom at 8.0
[Magisk] alptangal:
Tested in lineage os 21 with no result too
[Magisk] Wezyk123:
I cannot log in to this banking application when it is checked in the denylist.
[Magisk] hopeeeeee09:
Hi, this app still checkroot: https://play.google.com/store/apps/details?id=com.vnid&hl=en_US :((( when I use this module: http://download.omarea.com/#/versions . Can u see what this app checkroot, is so diffucult to pass check root.
[Magisk] Jordan20232:
Could you also take a look at liapp detection even with magisk hide and this module installed root is being detected
[Magisk] NEO701:
Hi snake-4, thanks for the latest update.

but the previous version was perfectly fine with Kitsune which is passing all detections including Momo test.

but I found the latest version to be detected by the below app (was working fine with v2.0.4).

Can you please check it ?

InstaPay Egypt - Apps on Google Play

With InstaPay, Transfer money instantly 24/7, and pay your bills.

play.google.com

I just wanted to make sure everything is working properly with latest update along side Kitsune before trying it again with the official Magisk/Canary.
[Magisk] Faakarna:
Adaway wont block ads anymore when zygisk assistant module is enabled. Anyone have a fix?
[Magisk] snake-4:
Make sure AdAway has root and is not denylisted. There's no such known issue at the moment. If you made sure everything is right on your end, feel free to make a bug report on GitHub.
[Magisk] sonepib591:
Nice

Please keep this active as community effort, not a personal project. It's a tired cat-mouse game for a single person
[Magisk] SebaS-DG:
Hello, can you help with this app called "modo"

I'm using magisk 26.4 kitsune

I can use official magisk if needed

Link for the app "modo":

MODO: Conectá tu dinero - Apps on Google Play

We transform the way you use your money. Safe, practical and convenient.

play.google.com

View attachment 6100686View attachment 6100687

View attachment 6100688View attachment 6100689
[Magisk] spida_singh:
Hey, thanks for this, PIF with KSU and ZygiskNext used to hide root for Starling Bank app in the UK.

The recent update introduced some additional checking mechanisms for root:-

Download Starling Bank - Mobile Banking APKs for Android - APKMirror

Download Starling Bank - Mobile Banking APKs for Android - APKMirror Free and safe Android APK downloads

www.apkmirror.com

3.46 runs OK, anything after that (currently 3.47 and 3.48), is there anyway you could check to see what its looking for and try to hide traces that Starling finds in your module?

Ive tried Shamiko, Lsposed with HMA etc, nothing works. No idea what its checking, but PIF managed to hide root from what i remember due to how it implemented resetprops (I could be wrong)
[Magisk] Captain_Throwback:
@snake-4 This blog post might be useful to see some additional things to hide:

Android 用户态注入隐藏已死 - Nullptr's Blog

前言隐藏注入一直是 Android 各种检测和反检测斗争的战场。实际上早在很久以前，各种外挂制作者就已经认识到，要在用户态中隐藏一个注入到 App 的动态库是不可能的，因此现在的外挂都是纯粹的内...

nullptr.icu
[Magisk] eac5:
imagin: More than mobile bank - Apps on Google Play

Your online bank. Card without fees. Control your expenses. Withdraw money

play.google.com

This app does not work when Zygisk Assistant is enabled. Detects root and after a few actions self-closes due to 'security issues'.

Works fine when disabling the module and keeping just shamiko
[Magisk] Captain_Throwback:
You shouldn't be using both Zygisk Assistant and Shamiko.

This app opens fine for me with Zygisk Assistant.
[Magisk] eac5:
Simply opening isn't an issue. Operating in it is impossible.

Here's the screenshots of what happens when it detects root. It's in Spanish, but basically it says "your phone is rooted, so you can't enable biometric login" and after entering via password "this app cannot be used in this environment, for security reasons it will be closed"

This happens when both shamiko and zygisk-

assistant are enabled, as well as with shamiko disabled and only Zygisk-Assistant. So the issue is in this module.
[Magisk] snake-4:
PIF managed to hide root from it? What do you mean by this? We're already tracking an issue related to ZygiskNext detection so I'd say it's related to that. I haven't had time to look into that issue yet but I added some information to help others figure it out.

It's probably not a problem but something that Shamiko hides and we don't. Since a few updates ago I added some function hooks and that makes Shamiko fail to place its own hooks in some cases.

Feel free to create an issue on GitHub. It's not easy to troubleshoot here especially if I can't reproduce the problem.

Thanks for the heads up! But this kind of map hiding is only useful for hiding Xposed modules from older apps such as Momo.

As of now, there are better methods for detecting Xposed modules (see Hunter for reference) so I'm not sure if it's worth the effort. Besides, zygisk-maphide implements exactly this method and it's compatible with this module, so it can be used for niche use cases.
[Magisk] littlecrap:
https://play.google.com/store/apps/details?id=id.co.btn.mobilebanking.android

Please check about this app, using zygisk assistant and maphide in magisk stable 27 couldn't hide the root it still found by the app.
[Magisk] Spartacus500:
Working open ok, Magisk 27.0 stable + Zygisk Assistant + Shamiko + Lsposed 1.7.3 + HMA 👍
[Magisk] Sirz606:
I made an acc just to say thank you! You have no idea ho much this module make thing alot easier for me, I can now open My local banking app without all the hassle. It simply works and delivered the promise!

PS: I use Ksu, Always.
[Magisk] Sirz606:
I spoke too soon, It actually broke my yt revanced module I tried to reinstall the YT module multiple time but no luck, Once i uninstalled yours and yt is working fine again, Is there anyway to mitigate this?
[Magisk] Sirz606:
Fixed, all worked. Thank you!
[Magisk] nadeemakhtar1994:
Tide Business India app detects magisk as soon as it is opened on Foss version 2.1.0 amd 2.1.1 both. So using foss version 2.0.4 as of now. Told developer about it already and he blames lsposed for it but my question is if lsposed is the culprit then how is it working with foss 2.0.4. anyone?

Tide Business India - Apps on Google Play

Tide is a business financial platform that helps you start doing what you love.

play.google.com
[Magisk] Spartacus500:
Working open ok 👍
[Magisk] bigbrain813:
Hi, I have a situation. It is not related to your module, but I could use the help if possible. Can you share how you can tell what the apps are checking for? I have an app that outright doesn't work when on a custom rom.

No root or modules of any sort, even in fresh install. This only began in the latest version, previous versions were fine if root was not detected. I'm on A14 EvoX on redmi note 12 turbo (marble) and device is certified in playstore.

BenefitPay - Apps on Google Play

Consumer application allowing customer to pay using their mobile in Bahrain.

play.google.com
[Magisk] nadeemakhtar1994:
Can you share magisk modules screenshot
[Magisk] sergej_7:
Payback detects root

Link to App: https://play.google.com/store/apps/details?id=de.payback.client.android

Model: Redmi Note 7 (Lavender)

ROM: LineageOS 21 (https://www.pling.com/p/1889410/)

KernelSU Manager: 0.7.6 (because any higher version leads to space fillup bug.)

LSposed: not installed.

Uninstalling/Freezing KSU Manager doesn't help either

Zygisk Next: v4-0.9.1.1

Zygisk Assistant: v2.1.1

Reset LOS Props: installed

Further measures:

addon.d folder removed

install-recovery.sh deleted from vendor/bin
[Magisk] pndwal:
App in denylist?... Taken Magisk App, Hide the Magisk app?... Passing PI DEVICE_INTEGRITY?... 🙂 PW
[Magisk] sergej_7:
{
"accountDetails": {
"appLicensingVerdict": "LICENSED"
},
"appIntegrity": {
"appRecognitionVerdict": "PLAY_RECOGNIZED",
"certificateSha256Digest": [
"_zjHvW5D0vMAQ78JM2p2uWx9XLBnXWGIsg7yiyrP7ec"
],
"packageName": "com.henrikherzig.playintegritychecker",
"versionCode": "7"
},
"deviceIntegrity": {
"deviceRecognitionVerdict": [
"MEETS_BASIC_INTEGRITY",
"MEETS_DEVICE_INTEGRITY"
]
},
"requestDetails": {
"nonce": "cjVIeTg4aDl4RGluZFQzcnM5TEx2eUFXN1IwekhiN3FTd2VIQ2RwMENLVXBFcFhEZ0Y\u003d",
"requestPackageName": "com.henrikherzig.playintegritychecker",
"timestampMillis": 1715413430802
}
}

{
"apkCertificateDigestSha256": [
"/zjHvW5D0vMAQ78JM2p2uWx9XLBnXWGIsg7yiyrP7ec\u003d"
],
"apkDigestSha256": "DptbkXD9gp0gJo6lxUSvpwb8DfNB29O7WvBnFbl4P9I\u003d",
"apkPackageName": "com.henrikherzig.playintegritychecker",
"basicIntegrity": true,
"ctsProfileMatch": true,
"evaluationType": "BASIC",
"nonce": "YmE0YzNkYzktNjFiOS00ODQ2LWEwNWMtMDg5YzgyZWY3MGM5",
"timestampMs": 1715413494953,
"deprecationInformation": "The app is allowlisted to use the SafetyNet Attestation API until the full turndown: https://g.co/play/safetynet-timeline."
}

Magisk Canary / CI + Shamiko not compatible in this rom. Shamiko reports abnormal environment that is why I started using kernelsu
[Magisk] pndwal:
No experience with KSU, but I'd have thought that for modules like this to work, they'd need to be mounted for the app, not unmounted? 🤔 ...KSU users, please clarify. 👍

Nb. Determined apps may detect many other traces like root related apps, Developer options, USB debugging, OEM unlocking, directories set up by TWRP, addon.d, Xposed modules etc... some of these need to be cleaned manually, eg XPrivacyLua notoriously leaves detectable data/system/xlua directory behind...

👀 PW