FORUMS
Remove All Ads from XDA
Honor 7x
Win an Honor 7X!

iSu [V6.3][5.1+] Simple app to deactivate activate CyanogenMod/LineageOS SU at will

2,872 posts
Thanks Meter: 6,775
 
Post Reply Email Thread
iSu by bhb27

I know that there is many tools apps etc to disable or hide SU.
I decide to make this just because those did't work on my device back in 2016 and or CyanogenMod/LineageOS ROM that I use, so I assume this happens to other in CyanogenMod/LineageOS users too and I start this thread and made this app that can help to pass a safety net test on any rooted device as it is no longer just a SU hider app is little more.

Click image for larger version

Name:	A01.png
Views:	1454
Size:	198.3 KB
ID:	4256629 Click image for larger version

Name:	A02.png
Views:	1536
Size:	252.8 KB
ID:	4256630
  • This is only to CyanogenMod/LineageOS SU binary aka CM-SU, the CM-SU only works with CyanogenMod/LineageOS ROM's and ROM that use they source code as base
  • That can be Download from Lineageos download page click here to see
  • No it doesn't work with SUPERSU or any other SU that is not base on CM-SU
  • No it doesn't support Xposed Hide, if you use Xposed you can't pass safety net with CM-SU.

What is iSu?
A simple app to help the user to pass safety net test on CyanogenMod/LineageOS or any CyanogenMod/LineageOS base ROM's.
I personally test this on Marshmallow and Nougat CM base ROM's it works 100%, it also Supports Lollipop but Kit Kat and older OS's are not supported.

How To use it?
  • read Installation instructions, download Folder with instructions on the bottom of the post
  • Download and Install the app as a normal app, if you wanna the full app support, use a ROM with the supported SU version (CM-SU), download Folder with instructions on the bottom of the post
  • if on Marshmallow or Lollipop flash the zip (iSu_kernel_Reboot_Support), download Folder with instructions on the bottom of the post
  • Learn how to use the app, below instructions

How To pass safety net?
  • Su deactivated (demanding)
  • SELinux enforced (demanding)
  • Android debugging deactivated (not demanding for all devices)
  • Props known props or special props can't have a red warning (demanding)
Below are some samples of fails or pass:
PASS
Click image for larger version

Name:	pass.png
Views:	2160
Size:	78.1 KB
ID:	4257299
*Android debugging only affects some devices, disable if you don't need it.
*In props if there is props with a red warning that may be the reason of the fail if SU and SELinux is set as the above.

If you have SU active you will always fail
FAIL everything
Click image for larger version

Name:	fail1.png
Views:	2030
Size:	83.3 KB
ID:	4257305
*Fail because SU is Activated

If you have SU deactivate you will not always pass
FAIL everything 2
Click image for larger version

Name:	fail2.png
Views:	1906
Size:	84.4 KB
ID:	4257324
*Fail because SELinux is in Permissive

If you have SU and SELinux on a correct position you may not always PASS, because some props cause fail of ctsProfile
FAIL ctsProfile
Click image for larger version

Name:	fail_bootstate.png
Views:	1476
Size:	129.1 KB
ID:	4257306
*The above fail because ro.boot.verifiedbootstate
*Some props may or may not cause full FAILS or a FAIL of ctsProfile


Detailed app function description?
The app is divided in 5 tabs (Checks, Controls, Monitor, Props and settings), plus widgets and tiles, bellow a detailed description:
Checks
Click image for larger version

Name:	checks.png
Views:	1376
Size:	45.6 KB
ID:	4256633
Basic information about the application, the main start tab if it show a red warning on the SU state options because yours current SU is not supported and the app will work with limited functionality.
  • SU State, current user SU version and reboot support status
  • Update, Check for iSu updates
  • Safety Net test, Let the user try the safety net status, in case of fail it will tell what fail and current SU, SELinux and ADB state as those if on wrong position will cause the fail
  • Log, Generate a full logs of information about the device and how the app is running, in case of a problem share the log.zip on the thread and explain the problem
Controls
Click image for larger version

Name:	controls.png
Views:	1280
Size:	57.5 KB
ID:	4256634
The main control tab, be aware there is extras actions for this controllers in settings tab
  • SU, Changes and show SU state. This function only works with CM-SU
  • SELinux, Changes and show SELinux state, plus allow user to fake enforce Selinux for devices that have problems when running with SELinux enforced
  • Android debugging, Changes and show Android debugging state
  • Tasker, Info about how to control the app using Tasker
Monitor
Click image for larger version

Name:	monitor.png
Views:	1128
Size:	125.1 KB
ID:	4256639 Click image for larger version

Name:	monitor2.png
Views:	944
Size:	65.3 KB
ID:	4257327
This tab only works with CM-SU
A Service to monitor when foreground app starts then, activate or deactivate SU and SELinux or ADB (base on settings options).
  • App monitor, Status and access to accessibility service.
  • Don't Care List, Select the apps that will not have effect to App monitor, when a foreground app start.
  • Deactivate SU, Select the apps that will deactivate SU when started
  • Automatic Re-Activate SU, If this switch is on, will automatic active SU when leave the app that deactivated SU
  • Activated SU, Select the apps that will activate SU when started
  • Automatic Re-Deactivate SU, If this switch is on, will automatic deactivate SU when leave the app that activated SU
Props
Click image for larger version

Name:	props.png
Views:	1024
Size:	132.5 KB
ID:	4256640 Click image for larger version

Name:	props2.png
Views:	876
Size:	170.2 KB
ID:	4257328
A tab to change the value of any ro.prop or read only prop, using the resetprop applets from magisk to make a tool to modify on the go any ro.prop, there is also a list of known props that can cause safety net fail they safe or unsafe value
  • Read Only editor, List of ro props and the ro props changed by the user
  • Special Props, Known props that has a complicated value that can't be define as OK or NOK
  • Known props list, just explanation about safe, unsafe or unknow values
  • Force set all Known props, Click to force all Known Props to the chosen value
  • Known props, the real list of known props and they current value click to change
Settings
Click image for larger version

Name:	settings.png
Views:	996
Size:	84.9 KB
ID:	4256641
Basic application setting, extra controls and notifications
  • Application, Allow to force language to English
  • SU, Extra SU options allow to deactivate it on boot This function only works with CM-SU
  • App monitor, Allow delays to app monitor This function only works with CM-SU
  • Props, Allow to apply props changes on boot
  • Notifications, Enable disable notifications or toast's of SU state This function only works with CM-SU
  • SELinux, Extra control of SELinux state base on SU is state changes This function only works with CM-SU
  • Android debugging, Extra control of Android debugging state base on SU is state changes This function only works with CM-SU
Widgets and tiles
Click image for larger version

Name:	widget_tile.jpg
Views:	964
Size:	127.1 KB
ID:	4256649
The app has widget and tiles that can be used to control the app Controls
Widgets They only work with CM-SU for SU changes
  • Mono Widget, Allow to change and read SU state, it also work with Settings extra controls (Notifications, SELinux and Android debugging)
  • Dual Widget, Allow to change and read SU or SELinux state, it also work with Settings extra controls (Notifications, SELinux and Android debugging)
Tiles Only visible on Nougat
  • SU tile, Allow to change and read SU state, it also work with Settings extra controls (Notifications, SELinux and Android debugging)
  • iSu tile, Click to open the app

Installation instructions:
Download Folder: Click Here

There is three files, description:
iSu_X_x.apk Install the apk as a normal app.
iSu_kernel_Reboot_Support_V_X_x_and_up.zip Flashable zip, flash only if you are running Marshmallow or Lollipop

Explanation of the above, iSu only need flashable reboot support for Marshmallow or older OS.
The kernel reboot support , this files prevents from losing SU access after a reboot with SU deactivated.

Old reboot support, in case the current fail

iSu_kernel_Reboot_Support_V_X_x_and_up_Enforcing.z ip Flashable zip, use only one zip, if running Marshmallow or older
iSu_kernel_Reboot_Support_V_X_x_and_up_Permissive. zip Flashable zip, use only one zip, if running Marshmallow or older

Explanation of the above, iSu only need flashable reboot support for Marshmallow or older OS.
The kernel reboot support use only one(enforcing or permissive), this files prevents from losing SU access after a reboot with SU deactivated.
Use the one base on yours current Selinux status to check on your device look in settings > About a phone > SELinux Status if is enforcing or permissive, some CM ROM Run with selinux in Permissive so check yours.

Be aware!!
Updating CM/Los nightly or any ROM update of any CM/Los base ROM will remove the changes made by the zip, so is need to re-flash those .zip after any ROM update, may be need to do it also with some custom kernel from developer that use a boot.img to share the kernel(check yours kernel zip content to know).
If you forget to flash the .zip in a update and have lost ROOT don't worry just go back to recovery and flash it after the reboot all will be good.
The below are obsolete after V3.6 of the app, see old_version folder in main download folder for those files just reference no longer supported

iSu_kernel_cmdline_Patch_V_X_x_and_up.zip
The kernel_cmdline is only need to some devices that after deactivating SU with the app still can't pass the safety check, Google is using kernel and bootloader arguments to determined that the user modify the stock SW(AKA is using custom ROM) and prevent from passing as "safe", this add extra safe arguments to cmline and help to achieve the pass current it only support some device (Nexus and Motorola, maybe other post on the thread device/vendor if the zip help you)

iSu_kernel_defaultprop_Patch_V_X_x_and_up.zip
This is only for those that have apps that use rootbeer SU detection...
explain in this post (Click here).
After flashing defaultprop_Patch zip the user will no longer have access to the option in Settings > Developer options > Root access
But that is not a problem as the same zip will enable root by default so you can use without changing that option.
[/SIZE]
XDA:DevDB Information
iSu, App for all CyanogenMod/LineageOS devices (see above for details)

Contributors
All Contributors can be see in github click here
bhb27, I use osm0sis Anykernel2 for the kernel zip
App Source Code: https://github.com/bhb27/isu
Extra App credits: iSu readme credits

Version Information
Status: Stable
Current Stable Version: Check latest version in Download folder
Changelog

Created 2016-Oct-03
Last Updated Check latest version
XDA Labs
The Following 66 Users Say Thank You to bhb27 For This Useful Post: [ View ]
 
 
11th October 2016, 04:58 PM |#2  
bhb27's Avatar
OP Recognized Developer
Flag Brazil...South of the south
Thanks Meter: 6,775
 
Donate to Me
More
Changelog
The Following 20 Users Say Thank You to bhb27 For This Useful Post: [ View ]
11th October 2016, 04:58 PM |#3  
bhb27's Avatar
OP Recognized Developer
Flag Brazil...South of the south
Thanks Meter: 6,775
 
Donate to Me
More
Last app version Click to Download
Attached Thumbnails
Click image for larger version

Name:	A01.png
Views:	1630
Size:	152.1 KB
ID:	4107218   Click image for larger version

Name:	A02.png
Views:	1624
Size:	223.5 KB
ID:	4107219  
The Following 16 Users Say Thank You to bhb27 For This Useful Post: [ View ]
3rd November 2016, 02:08 AM |#4  
blastagator's Avatar
Recognized Contributor
Flag Kissimmee
Thanks Meter: 4,463
 
Donate to Me
More
Awesome work! Glad I accidentally stumbled on to this. Magisk stopped working to hide root but this is still good. Woot!


edit: In your isu.sh, shouldn't the end of the script be:

Code:
mount -o ro,remount /system
# instead of
umount /system;
edit 2: For anyone who wants to build their device/kernel with support baked in, so they don't have to patch, I distilled the changes down from your git and created this patch:
https://github.com/blastagator/cm_de...5751c7e6b8fdc5
This should be a good basis for others to manually patch in support. Working well on my custom cm13 builds.
The Following 3 Users Say Thank You to blastagator For This Useful Post: [ View ] Gift blastagator Ad-Free
3rd November 2016, 07:33 AM |#5  
bhb27's Avatar
OP Recognized Developer
Flag Brazil...South of the south
Thanks Meter: 6,775
 
Donate to Me
More
Quote:
Originally Posted by blastagator

Awesome work! Glad I accidentally stumbled on to this. Magisk stopped working to hide root but this is still good. Woot!


edit: In your isu.sh, shouldn't the end of the script be:

Code:
mount -o ro,remount /system
# instead of
umount /system;
edit 2: For anyone who wants to build their device/kernel with support baked in, so they don't have to patch, I distilled the changes down from your git and created this patch:
https://github.com/blastagator/cm_de...5751c7e6b8fdc5
This should be a good basis for others to manually patch in support. Working well on my custom cm13 builds.

Thanks. For me was similar, magisk did not support my device so user complain to me about support as I did not manage to make magisk to work on my device I manage to make this that seems to be 100% for the most none rooted app.

regards the RW/RO
Theoretically yes but things was a little odd when I first start test for this... for simple reason if we don't mount system as RW we can "hide" or "un-hide" SU because is need to move it and system boot in RO, and if leave it mounted as RW safety net check will not be successful even if SU is hide, but after some safety net update on the google side mount it as RO at the end was not working in the .sh and the unmout was, maybe was some other related problem but it work so I did not change...

So I keep the unmount did not test any more after, and in the java code every time the switch is use it start with RW and ends with RO and that does the trick...

I have update the reboot support and the app for Nougat, Selinux is a little more restricted on N and I did not had the time to test a universal .zip to support N as the changes I did in the ROM I build are a little more time demanding to make it right, or not I really only have my build to test on my devices as N is just starting there is no other ROM, I really need another ROM that doesn't have any of my changes to test and really make it fully work with a simple .zip

But every things is also fully working on N CM did not change the SU binary, safety net, pokemon and payment app are all good, at least for know...

The Following User Says Thank You to bhb27 For This Useful Post: [ View ]
3rd November 2016, 07:48 AM |#6  
bhb27's Avatar
OP Recognized Developer
Flag Brazil...South of the south
Thanks Meter: 6,775
 
Donate to Me
More
I update the project for N but I only manage to fully test on my ROM so if any one try and have problem read #3 post and report on the thread.
5th November 2016, 11:19 PM |#7  
Junior Member
Thanks Meter: 3
 
More
Hey guys, just tried out this in my Redmi Note 2 Prime with Bule's (cleaned) MoKee ROM CM12.1, and worked great, until now, because says, when I'm going to "hide" su, that the "su state change fail" Don't know for what it was, but if you can help me solving this, I would be grateful
7th November 2016, 03:16 AM |#8  
mrkhigh's Avatar
Senior Member
Thanks Meter: 559
 
More
Bhb thank you, using on my daughter's xt1254 phone now which runs cm 13.

---------- Post added at 03:16 AM ---------- Previous post was at 03:12 AM ----------

Quote:
Originally Posted by Shadow646

Hey guys, just tried out this in my Redmi Note 2 Prime with Bule's (cleaned) MoKee ROM CM12.1, and worked great, until now, because says, when I'm going to "hide" su, that the "su state change fail" Don't know for what it was, but if you can help me solving this, I would be grateful

This is the reason for the kernel hack.
Without it you can lose root.

Dirty flash your ROM and if the kernel hack won't work
Then just be sure to set everything back to normal before any reboots.

I "THINK" then you would be okay.
The Following User Says Thank You to mrkhigh For This Useful Post: [ View ] Gift mrkhigh Ad-Free
7th November 2016, 03:20 AM |#9  
Junior Member
Thanks Meter: 3
 
More
Quote:
Originally Posted by mrkhigh

Bhb thank you, using on my daughter's xt1254 phone now which runs cm 13.

---------- Post added at 03:16 AM ---------- Previous post was at 03:12 AM ----------



This is the reason for the kernel hack.
Without it you can lose root.

Dirty flash your ROM and if the kernel hack won't work
Then just be sure to set everything back to normal before any reboots.

I "THINK" then you would be okay.

Yeah, I did that, but dunno if was because of that it failed, or not... I'm fine for now, reverting it whenever I close the game, I put su back Maybe it was because I was trying to cheat on PoGO, and didn't work with Fly GPS, and uninstalling the app in a bad way provoked that I will do a nandroid and try again
7th November 2016, 03:22 AM |#10  
mrkhigh's Avatar
Senior Member
Thanks Meter: 559
 
More
Edit
7th November 2016, 10:25 PM |#11  
bhb27's Avatar
OP Recognized Developer
Flag Brazil...South of the south
Thanks Meter: 6,775
 
Donate to Me
More
Quote:
Originally Posted by Shadow646

Yeah, I did that, but dunno if was because of that it failed, or not... I'm fine for now, reverting it whenever I close the game, I put su back Maybe it was because I was trying to cheat on PoGO, and didn't work with Fly GPS, and uninstalling the app in a bad way provoked that I will do a nandroid and try again

Are you using the kernel support, have you flash it in TWRP?

The app work in CM under 13 is ok, but the kernel support I have not tested in older them CM13, so I'm curious to know if it works, the only way to really test is to deactivate SU and then reboot if you have SU active after or if the app can activate SU after then is all good if you don't have and or can't activate in the app there is a problem...

the basic function of the kernel support is to have no problem after a reboot when you had disable SU, just like @mrkhigh point it out

So if you reboot with that off let me know the behavior if you can use and activate SU will be need a dirty flash of the ROM you are using...

When I have some time I will do some proper test in cm12.1 and only cm12.1 because my devices can only run that there is no older OS for me...

The Following User Says Thank You to bhb27 For This Useful Post: [ View ]
Post Reply Subscribe to Thread

Tags
cm su, cyanogenmod, lineageos, safety net, safetynet

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes