I'd like to know exactly why XPosed trips the SafteyNet checks even when running as a Magisk module. Is there a change that's easy to detect? Is it not possible to isolate the changes to certain apps? I want all the technical details about this issue.
Why Does XPosed Always Trip SafetyNet?
- Thread starter gudenau
- Start date
But there's systemless xposed which still triggers safety net. So it can't be just that.
Gesendet von meinem Moto G 2014 LTE mit Tapatalk
aer0zer0
Recognized Contributor
safetynet checks the zygote, which xposed modifies to work, thats why it trips, be it system or systemless, it didnt used to. Safetynet has evolved
I don't get how a root-level app can't fool a non-root level app such as Google Play into thinking nothing's rotten in Denmark :crying::crying:
aer0zer0
Recognized Contributor
I'm sure if they could spoof the zygote, or force it back as a pass like the bootloader and kernel, they would have done it already. Root is not exactly the entire solution
aer0zer0
Recognized Contributor
aer0zer0
Recognized Contributor
Lol, already saw that (it was in my earlier explanation) I think others in this thread want a more nuts and bolts answer.
Sure it checks it, but what does it look for? I want to know exactly what it does, as I said in the first post.
Nice thread going on here. Hope someone could explain the anathomy of SafetyNet and how does it check Zygote.
I believe if anybody actually KNEW this answer, they'd be able to spoof it. It could be some kind of tamper-detection stuff on the level that serious hackers use (e.g. measuring execution time of an arbitrary method), or it could be specifically design to detect Xposed (it is opensource after all).
This is one of those things where if you have to ask the question, the answer is probably beyond your expertise.
I'm watching this talk from 34c3.
Maybe this would explain/help on under standing saftynet.
https://media.ccc.de/v/34c3-8725-inside_android_s_safetynet_attestation_attack_and_defense
Maybe this would explain/help on under standing saftynet.
https://media.ccc.de/v/34c3-8725-inside_android_s_safetynet_attestation_attack_and_defense
I think topjohnwu already explained well enough. Since SN checks not the "file integrity" of Zygote but the integrity of the running Zygote process in memory, it makes the spoof very difficult.
Since Zygote is loaded very early during boot and is actually the base of all system and app process (this is also why XPosed is so powerful by modifying Zygote), so it's always running and it's not so easy to spoof the memory contents (including code and data area) of a running process from another process, so there SN is tripped always.
However since there Zygote is modified by XPosed, maybe someone can modify the Zygotes in such a way that will pretent the integrity and thus will not trip safety net (like some root kit for Windows) but how and if this can be done is entirely beyond my knowledge...
Since Zygote is loaded very early during boot and is actually the base of all system and app process (this is also why XPosed is so powerful by modifying Zygote), so it's always running and it's not so easy to spoof the memory contents (including code and data area) of a running process from another process, so there SN is tripped always.
However since there Zygote is modified by XPosed, maybe someone can modify the Zygotes in such a way that will pretent the integrity and thus will not trip safety net (like some root kit for Windows) but how and if this can be done is entirely beyond my knowledge...
I'd like to discover some technical details too. I wonder if it's possible to compile a ROM with modified zygote binary that chain-loads Xposed stuff or something like that. But I'd need to first find out what exactly Xposed Zygote does differently, and go through trial and error with modifying zygote sources to find what actually trips it.
Similar threads
- Locked
- Sticky
Top Liked Posts
-
There are no posts matching your filters.
-
3
I believe if anybody actually KNEW this answer, they'd be able to spoof it. It could be some kind of tamper-detection stuff on the level that serious hackers use (e.g. measuring execution time of an arbitrary method), or it could be specifically design to detect Xposed (it is opensource after all).
This is one of those things where if you have to ask the question, the answer is probably beyond your expertise.2I'm watching this talk from 34c3.
Maybe this would explain/help on under standing saftynet.
https://media.ccc.de/v/34c3-8725-inside_android_s_safetynet_attestation_attack_and_defense1
safetynet checks the zygote, which xposed modifies to work, thats why it trips, be it system or systemless, it didnt used to. Safetynet has evolved
