I know that there is many tools apps etc to disable or hide SU.
I decide to make this just because those did't work on my device back in 2016 and or CyanogenMod/LineageOS ROM that I use, so I assume this happens to other in CyanogenMod/LineageOS users too, I start this thread and made this app that can help to pass a safety net test on any rooted device (hide SU only when using Lineage add on SU) as it is no longer just a SU hider app is little more.
- This is only to CyanogenMod/LineageOS SU binary aka CM-SU, the CM-SU only works with CyanogenMod/LineageOS ROM's and ROM that use they source code as base
- That can be Download from Lineageos download page click here to see
- No it doesn't work with SUPERSU or any other SU that is not base on CM-SU
- No it doesn't support Xposed Hide, if you use Xposed you can't pass safety net with CM-SU.
- No it doesn't support AB devices (devices with two system partition) that can't be mounted as rw dynamically in android.
What is iSu?
A simple app to help the user to pass safety net test on CyanogenMod/LineageOS or any CyanogenMod/LineageOS base ROM's.
I personally test this on Marshmallow and Nougat CM base ROM's it works 100%, it also Supports Lollipop but Kit Kat and older OS's are not supported.
How To use it?
- read Installation instructions, download Folder with instructions on the bottom of the post
- Download and Install the app as a normal app, if you wanna the full app support, use a ROM with the supported SU version (CM-SU), download Folder with instructions on the bottom of the post
- if on Marshmallow or Lollipop flash the zip (iSu_kernel_Reboot_Support), download Folder with instructions on the bottom of the post
- Learn how to use the app, below instructions
How To pass safety net?
- Su deactivated (demanding)
- SELinux enforced (demanding)
- Android debugging deactivated (not demanding for all devices)
- Props known props or special props can't have a red warning (demanding)
*Android debugging only affects some devices, disable if you don't need it.
*In props if there is props with a red warning that may be the reason of the fail if SU and SELinux is set as the above.
If you have SU active you will always fail
*Fail because SU is Activated
If you have SU deactivate you will not always pass
FAIL everything 2
*Fail because SELinux is in Permissive
If you have SU and SELinux on a correct position you may not always PASS, because some props cause fail of ctsProfile
*The above fail because ro.boot.verifiedbootstate
*Some props may or may not cause full FAILS or a FAIL of ctsProfile
Detailed app function description?
The app is divided in 5 tabs (Checks, Controls, Monitor, Props and settings), plus widgets and tiles, bellow a detailed description:
Basic information about the application, the main start tab if it show a red warning on the SU state options because yours current SU is not supported and the app will work with limited functionality.
- SU State, current user SU version and reboot support status
- Update, Check for iSu updates
- Safety Net test, Let the user try the safety net status, in case of fail it will tell what fail and current SU, SELinux and ADB state as those if on wrong position will cause the fail
- Log, Generate a full logs of information about the device and how the app is running, in case of a problem share the log.zip on the thread and explain the problem
The main control tab, be aware there is extras actions for this controllers in settings tab
- SU, Changes and show SU state. This function only works with CM-SU
- SELinux, Changes and show SELinux state, plus allow user to fake enforce Selinux for devices that have problems when running with SELinux enforced
- Android debugging, Changes and show Android debugging state
- Tasker, Info about how to control the app using Tasker
This tab only works with CM-SU
A Service to monitor when foreground app starts then, activate or deactivate SU and SELinux or ADB (base on settings options).
- App monitor, Status and access to accessibility service.
- Don't Care List, Select the apps that will not have effect to App monitor, when a foreground app start.
- Deactivate SU, Select the apps that will deactivate SU when started
- Automatic Re-Activate SU, If this switch is on, will automatic active SU when leave the app that deactivated SU
- Activated SU, Select the apps that will activate SU when started
- Automatic Re-Deactivate SU, If this switch is on, will automatic deactivate SU when leave the app that activated SU
A tab to change the value of any ro.prop or read only prop, using the resetprop applets from magisk to make a tool to modify on the go any ro.prop, there is also a list of known props that can cause safety net fail they safe or unsafe value
- Read Only editor, List of ro props and the ro props changed by the user
- Special Props, Known props that has a complicated value that can't be define as OK or NOK
- Known props list, just explanation about safe, unsafe or unknow values
- Force set all Known props, Click to force all Known Props to the chosen value
- Known props, the real list of known props and they current value click to change
Basic application setting, extra controls and notifications
- Application, Allow to force language to English
- SU, Extra SU options allow to deactivate it on boot This function only works with CM-SU
- App monitor, Allow delays to app monitor This function only works with CM-SU
- Props, Allow to apply props changes on boot
- Notifications, Enable disable notifications or toast's of SU state This function only works with CM-SU
- SELinux, Extra control of SELinux state base on SU is state changes This function only works with CM-SU
- Android debugging, Extra control of Android debugging state base on SU is state changes This function only works with CM-SU
The app has widget and tiles that can be used to control the app Controls
Widgets They only work with CM-SU for SU changes
- Mono Widget, Allow to change and read SU state, it also work with Settings extra controls (Notifications, SELinux and Android debugging)
- Dual Widget, Allow to change and read SU or SELinux state, it also work with Settings extra controls (Notifications, SELinux and Android debugging)
- SU tile, Allow to change and read SU state, it also work with Settings extra controls (Notifications, SELinux and Android debugging)
- iSu tile, Click to open the app
Download Folder: Click Here
There is three files, description:
iSu_X_x.apk Install the apk as a normal app.
iSu_kernel_Reboot_Support_V_X_x_and_up.zip Flashable zip, flash only if you are running Marshmallow or Lollipop
Explanation of the above, iSu only need flashable reboot support for Marshmallow or older OS.
The kernel reboot support , this files prevents from losing SU access after a reboot with SU deactivated.
Old reboot support, in case the current fail
iSu_kernel_Reboot_Support_V_X_x_and_up_Enforcing.z ip Flashable zip, use only one zip, if running Marshmallow or older
iSu_kernel_Reboot_Support_V_X_x_and_up_Permissive. zip Flashable zip, use only one zip, if running Marshmallow or older
Explanation of the above, iSu only need flashable reboot support for Marshmallow or older OS.
The kernel reboot support use only one(enforcing or permissive), this files prevents from losing SU access after a reboot with SU deactivated.
Use the one base on yours current Selinux status to check on your device look in settings > About a phone > SELinux Status if is enforcing or permissive, some CM ROM Run with selinux in Permissive so check yours.
Updating CM/Los nightly or any ROM update of any CM/Los base ROM will remove the changes made by the zip, so is need to re-flash those .zip after any ROM update, may be need to do it also with some custom kernel from developer that use a boot.img to share the kernel(check yours kernel zip content to know).
If you forget to flash the .zip in a update and have lost ROOT don't worry just go back to recovery and flash it after the reboot all will be good.
The below are obsolete after V3.6 of the app, see old_version folder in main download folder for those files just reference no longer supported
The kernel_cmdline is only need to some devices that after deactivating SU with the app still can't pass the safety check, Google is using kernel and bootloader arguments to determined that the user modify the stock SW(AKA is using custom ROM) and prevent from passing as "safe", this add extra safe arguments to cmline and help to achieve the pass current it only support some device (Nexus and Motorola, maybe other post on the thread device/vendor if the zip help you)
This is only for those that have apps that use rootbeer SU detection...
explain in this post (Click here).
After flashing defaultprop_Patch zip the user will no longer have access to the option in Settings > Developer options > Root access
But that is not a problem as the same zip will enable root by default so you can use without changing that option.
iSu, App for all CyanogenMod/LineageOS devices (see above for details)
Developer donation link:
To donate via paypal click here
No other donation option is available.
All Contributors can be see in github click here
fgl27, I use osm0sis Anykernel2 for the kernel zip
App Source Code: https://github.com/fgl27/isu
Extra App credits: iSu readme credits
Current Stable Version: Check latest version in Download folder
Last Updated Check latest version