[Magisk] pndwal:
Latecomer; just taking a look at this module now... 👍

Few thoughts/queries:

Seems there's various ways to use permissions etc to acquire applist... App's should not detect other apps, especially since changes in A11, making this practice an abuse of Google policy.

Banks are in fact employing 'dirty' tricks for such app detections... In practice some trickery, eg using Intent queries instead of API requests, using permissions like QUERY_ALL_PACKAGES (Google has introduced means to vet use of such sensitive permissions and approve only in specific instances in later Android, but it's not foolproof) and detecting classes.dex code (which does not change w/ basic app obfuscation unlike the package name) and then using simple pattern-matching to identify the app (eg Sparkasse push-TAN w/ Promon security engine was detecting the Magisk App this way even when obfuscated in stub w/ Hide the Magisk app function), allows bank Devs to bypass Google's A11 API level app detection preventions etc... I put more detail here:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-87680209

However, the Hide My Applist Xposed module effectively bypasses all of the above means of identifying installed apps so bank apps etc. doing this can be used in most cases...

Compatibility for LSPosed is essential however...

LSPosed can hide itself, and Xposed modules, like apps, are hidden when added in HMA App manage list.

After reading this comment some time ago:

it seems to me that inbuilt USNF hiding (root from droidguard + main GMS processes) and now PIF hiding, which derives from @kdrag0n's code even if it's no longer a fork (due to rewrites), has the same issue as manually adding GMS in basic denylist (or hidelist alternatives), ie. inbuilt PIF hiding breaks font modules by concealing font files from Play Services -> crash/instability...

Shamiko fixes issue for items in denylist since Shamiko v0.7:

• 2. Fix font loading

so if the Droidguard/attestation process, com.google.android.gms.unstable and main process, com.google.android.gms are added to (disabled) denylist*, custom font issues are fixed as Shamiko root hiding is used for GMS instead of PIF's internal hiding...

* Nb. PIF won't remove them on reboot unless DenyList is enforced... Only denylist functions break PIF, hidelist solutions don't, and of course Shamiko and Zygisk Assistant work in hidelist mode despite hijacking list from DenyList.

I don't know how Shamiko v0.7, ' • Fix font loading' works but seems it passes on the (erroneously?) hidden font files...

If your module is compatible with (doesn't override) this Shamiko function, Shamiko users should still be able to use custom fonts

by adding the GMS processes (above) to (disabled) denylist...

[Related issue/workarounds:

https://github.com/nongthaihoang/custom_font_installer/issues/1#issuecomment-994832687]

Please can you confirm that the module hides 'sensitive' props including original MagiskHide sensitive props?

This is

important for users who may want your module as a standalone fix for Play Integrity MEETS_DEVICE_INTEGRITY

with droidguard/attestation (and possibly main) GMS process added to (unenforced) denylist, ie for devices not requiring main PIF functions (fallback to basic attestation and bypasses for server side HARDWARE_BACKED evaluationType enforcement needed where Keymaster 3+ implementations exist and work) like devices launched prior to Android 8.0 or later devices with broken keymaster/chain of trust implementations (eg so many OnePlus models)...

Nb. Devices running Android 6 or 7 ROMs can't run PIF (for sensitive prop spoofing) although they may be able to use @osm0sis's fork in script-only mode, and those on Android 8.0 can't use Shamiko (also adjusts these props)... In these cases especially, sensitive prop adjustment will be useful in this module.

👍

Thanks for great work! 🤠 PW