Banking app (Starling) detecting Magisk

Search This thread
By:
Advanced…
P

pndwal

Senior Member
Jun 23, 2016
7,033
8,119
Sydney
Redmi Note 8
Xiaomi Redmi Note 8 (2021)
giociampa said:
As it happens I think I've found a way around the root check - whether it's permanent or not, only time can tell...

1. Open Magisk (Canary 26.1.02)
2. Configure the Denylist
3. Install/enable the (Displax) USNF and (HuskyDG) MagiskHide modules
4. Disable Zygisk and the Denylist (and reboot)
5. Open Starling - this should start without failing
(I had cleared the Starling data, so needed this)
7. Go through the device registration process
(I also needed Google Wallet to work, so)
8. Enable Zygisk but NOT the Denylist (and reboot)
(Both Starling and Wallet now work)
Click to expand...
Click to collapse
MagiskHide (proper root hiding) will be better than Denylist anyway, but Shamiko is usually better still... You'll need MagiskHide for step 5 of course...

I'm still confused by step 6 though. 😜
Nekromantik said:
What ROM and Device?
I thought everyone who turned zygisk on would see starling root message unless you kept magisk hide and leave zygisk off but then loose wallet
Click to expand...
Click to collapse
... Might be in 1 or 2 week grace period after detection?... PW
 
  • Like
Reactions: giociampa
M

makeyourself

Senior Member
Aug 26, 2012
228
106
giociampa said:
As it happens I think I've found a way around the root check - whether it's permanent or not, only time can tell...

1. Open Magisk (Canary 26.1.02)
2. Configure the Denylist
3. Install/enable the (Displax) USNF and (HuskyDG) MagiskHide modules
4. Disable Zygisk and the Denylist (and reboot)
5. Open Starling - this should start without failing
(I had cleared the Starling data, so needed this)
7. Go through the device registration process
(I also needed Google Wallet to work, so)
8. Enable Zygisk but NOT the Denylist (and reboot)
(Both Starling and Wallet now work)
Click to expand...
Click to collapse
Don't think you need USNF for Starling to work, the Starling app doesn't care about SafetyNet. Though it's needed for Google Pay obviously. As for DenyList, don't think that matters for Starling either once you've logged in and turned on Zygisk. Unless you have indeed found a way around it 🙂
pndwal said:
MagiskHide (proper root hiding) will be better than Denylist anyway, but Shamiko is usually better still...
Click to expand...
Click to collapse
Shamiko doesn't seem to help for Starling right now unfortunately. And the fact it's closed source makes it quite difficult to tell exactly why it's not working.
pndwal said:
I'm still confused by step 6 though. 😜
Click to expand...
Click to collapse
InstructionHide possibly ?? 😀
pndwal said:
... Might be in 1 or 2 week grace period after detection?... PW
Click to expand...
Click to collapse
I suspect so. Once I'm logged in the 14 day countdown only shows up for me if I keep tapping back when the Starling app is on screen. Either way the countdown starts as soon as I turn on Zygisk, even if I don't see the countdown notice straight away.
 
Lord Sithek

Lord Sithek

Senior Member
Dec 19, 2018
1,465
786
Xiaomi Redmi Note 4
Huawei Watch 2
P

pndwal

Senior Member
Jun 23, 2016
7,033
8,119
Sydney
Redmi Note 8
Xiaomi Redmi Note 8 (2021)
makeyourself said:
Don't think you need USNF for Starling to work, the Starling app doesn't care about SafetyNet. Though it's needed for Google Pay obviously. As for DenyList, don't think that matters for Starling either once you've logged in and turned on Zygisk. Unless you have indeed found a way around it 🙂

Shamiko doesn't seem to help for Starling right now unfortunately. And the fact it's closed source makes it quite difficult to tell exactly why it's not working.
Click to expand...
Click to collapse
Quite... I just left Shamiko and USNF installed but both are simply disabled when Zygisk is disengaged and deviceIntegrity is failing of course, but MagiskHide can be enabled instead of DenyList/Shamiko in Alpha Magisk to allow Starling to open without detection of root...

Once logged in, disabling MagiskHide and enabling Zygisk restores both Shamiko (which may be needed for other bank apps) and USNF (for other banks and G Pay/Wallet)... Of course Shamiko can't help for Starling while Zygisk is detected. 😜
makeyourself said:
InstructionHide possibly ?? 😀
Click to expand...
Click to collapse
😂
makeyourself said:
I suspect so. Once I'm logged in the 14 day countdown only shows up for me if I keep tapping back when the Starling app is on screen. Either way the countdown starts as soon as I turn on Zygisk, even if I don't see the countdown notice straight away.
Click to expand...
Click to collapse
👍 PW
 
P

pndwal

Senior Member
Jun 23, 2016
7,033
8,119
Sydney
Redmi Note 8
Xiaomi Redmi Note 8 (2021)
Lord Sithek said:
Does HuskyDG's USNF fork for Riru help with passing Play Integrity currently?
Click to expand...
Click to collapse
I believe It would (possibly in combination with his sensitive props fix module) and manually adding gms attestation/droidguard + gms main processes in hidelist as I mentioned here:
https://forum.xda-developers.com/t/banking-app-starling-detecting-magisk.4576421/post-88577473

The problem is:
pndwal said:
Despite allowing deviceIntegrity pass, this may well cause Starling Bank to fail as it can detect native bridge loaded Zygisk injection into zygote... It may well be be able to detect Riru (also NB loaded) injection/hooking too.
Click to expand...
Click to collapse

Someone could test to see if Riru hooking is detected also, but I suspect NB Zygisk hooking/injection hiding will be fixed soon in any case and it is expected to roll out with 27.0 official Magisk... The LSP devs are aware or native bridge hiding issues in latest Alpha anyhow.

🤠 PW
 
  • Like
Reactions: djcsurf and Lord Sithek
giociampa

giociampa

Senior Member
Feb 22, 2012
265
94
Trowbridge
Moto G5 Plus
Moto G 5G Plus
Nekromantik said:
yeah I think @giociampa will see root message soon as they turned zygsik back on
ideally we need way to hide root without zygisk and saftynet fix for wallet both at same time so not using zygisk breaks wallet.
Click to expand...
Click to collapse
Nothing yet - maybe I've got something else in the denylist that is relevant (the following list is probably overkill admittedly, but you never know)

Android Services Library
Device Policy
Google Carrier Services
Google Connectivity Services
Google Play Games
Google Play Services for ARCore
Google Play Store
Google Support Services
Google Wallet

(Plus of course Starling and a number of other apps that complain about root)

Note that I've ticked every checkbox for all of these, not just those that the app ticks by default.

Modules.pngZygisk.png
 
  • Like
Reactions: Stillhard
N

Nekromantik

Senior Member
Apr 1, 2010
6,927
1,005
London
Google Pixel 7 Pro
Google Pixel Watch
giociampa said:
Nothing yet - maybe I've got something else in the denylist that is relevant (the following list is probably overkill admittedly, but you never know)

Android Services Library
Device Policy
Google Carrier Services
Google Connectivity Services
Google Play Games
Google Play Services for ARCore
Google Play Store
Google Support Services
Google Wallet

(Plus of course Starling and a number of other apps that complain about root)

Note that I've ticked every checkbox for all of these, not just those that the app ticks by default.

View attachment 5922529View attachment 5922531
Click to expand...
Click to collapse
Interesting. However your using zygisk so the Magisk hide module doesn't do anything as it requires Magisk off I think
 
M

makeyourself

Senior Member
Aug 26, 2012
228
106
@giociampa could you please try the following:
* Force stop the Starling app
* Launch the Starling app and authenticate/login
* Keep pressing the "back" button until the app exits

Do you now see the warning about your device not passing security checks?
 
giociampa

giociampa

Senior Member
Feb 22, 2012
265
94
Trowbridge
Moto G5 Plus
Moto G 5G Plus
makeyourself said:
@giociampa could you please try the following:
* Force stop the Starling app
* Launch the Starling app and authenticate/login
* Keep pressing the "back" button until the app exits

Do you now see the warning about your device not passing security checks?
Click to expand...
Click to collapse
I do see the message now, yes.

That seems like an odd way to show it, on the way out rather than on the way in - I assume that it has been present the whole time and I just didn't know it was there?

What happens after the 14 days? Do I have to wipe the app, then reinitialise it (with Zygisk turned off, given that I can update the Denylist from the command line)?
 
M

makeyourself

Senior Member
Aug 26, 2012
228
106
giociampa said:
I do see the message now, yes.

That seems like an odd way to show it, on the way out rather than on the way in - I assume that it has been present the whole time and I just didn't know it was there?

What happens after the 14 days? Do I have to wipe the app, then reinitialise it (with Zygisk turned off, given that I can update the Denylist from the command line)?
Click to expand...
Click to collapse
It is a bit odd the way it shows up like that yes. If you clear the app's data and turn off Zygisk then the warning will go away. Until you turn on Zygisk again, upon which the 14 day countdown will begin again. If you've already been using it for a few days with Zygisk turned on then presumably you have less than 14 days left at the moment.
 
  • Like
Reactions: giociampa
M

michalrobeck

Senior Member
Jul 29, 2011
52
26
Has anyone managed to get it working with KernelSU?
I got a fresh version of Evo X on a K20 Pro and it's still detected 😕
 
M

makeyourself

Senior Member
Aug 26, 2012
228
106
michalrobeck said:
Has anyone managed to get it working with KernelSU?
I got a fresh version of Evo X on a K20 Pro and it's still detected 😕
Click to expand...
Click to collapse
I did try it with KernelSU a few days ago on LineageOS (with a custom kernel) and Starling was working fine, root not detected IIRC. But still, SafetyNet does not pass with KernelSU, it needs Zygisk and USNF. Which means it's no better solution than Magisk. If KernelSU doesn't work for you just try Magisk + HuskyDG MagiskHide.
 
M

michalrobeck

Senior Member
Jul 29, 2011
52
26
Azzlan said:
Or you can just use my method and click the link I posted to allow initial log in. No wipe or turning zygisk off required!
Click to expand...
Click to collapse
Just wanted to say that can confirm that this definitely works.
I had to leave the app open on the "takes 30 minutes to approve" on my second try. First try I closed it and looks like the app got closed by Android.

However got the 14 day countdown now. When I open the app and continue going back it shows it. I guess I'll try magisk delta (which is magisk by huskydg)

Do wonder how long it'll take them to patch out the browser workaround 🤔
 
You must log in or register to reply here.

Similar threads

T
  • Sticky
Magisk General Support / Discussion
Replies
57K
Views
6M
BillGoss
BillGoss
T
  • Locked
  • Sticky
Magisk - The Magic Mask for Android
Replies
56
Views
6M
T
topjohnwu
T
  • Locked
[CLOSED][BETA][2018.7.19] Magisk v16.7 (1671)
Replies
7K
Views
3M
T
topjohnwu
yochananmarqos
Collection of Magisk Modules v2
Replies
1K
Views
1M
J
jacomail95
Didgeridoohan
  • Sticky
[MODULE] [DEPRECATED] MagiskHide Props Config - SafetyNet, prop edits, and more - v6.1.2
Replies
7K
Views
1M
P
pndwal

Top Liked Posts

24 Hours 30 Days All time
  • There are no posts matching your filters.
  • 1
    giociampa
    giociampa
    makeyourself said:
    Do you have Starling on the Deny/Hide list in Magisk Delta? I think Magisk Delta has got HuskyDG's MagiskHide module built-in so I'd guess that's probably why. Same effect can be had with Magisk Official plus the MagiskHide module. And you presumably have Zygisk turned off?
    Click to expand...
    Click to collapse
    I have it set up the other way around, meaning that nothing sees su other than the apps I allow...
    View
    1
    N
    Nekromantik
    makeyourself said:
    I only have to disable Play Services because otherwise Google Pay detects that Play Integrity has failed (because turning Zygisk off causes the Universal SafetyNet Fix module to stop working). If you aren't using Google Pay or anything else relying on SN/PI then yeah that bit isn't necessary.
    Click to expand...
    Click to collapse
    ah ok
    for me to get g pay to work after disabling of zygisk i just clear cache of play services after enabling zygisk and UNSf module and reboot
    View
    1
    M
    makeyourself
    Nekromantik said:
    ah ok
    for me to get g pay to work after disabling of zygisk i just clear cache of play services after enabling zygisk and UNSf module and reboot
    Click to expand...
    Click to collapse
    Oh right, thanks, will try that as that would clearly be a bit easier.
    View
  • 8
    S
    spida_singh
    makeyourself said:
    A banking app I've been using for years has always worked after putting it on the Deny List. I updated it recently and it now won't work with Magisk installed regardless of what I do.

    As soon as I patch the boot image with Magisk it complains that the device is rooted and locks me out. That's without even installing the Magisk app, also without Zygisk etc.

    I can pass SafetyNet and Play Protect certification with Universal Safety Net Fix and Magisk Hide Props Config modules. However that doesn't make the banking app work.

    So far I've also tried:
    * Magisk Delta, Zygisk off, with sulist on whitelist mode (also tried Delta's Magisk Hide)
    * Shamiko
    * Hide My Applist (various configs)
    * Disabling root from Magisk app
    * Renaming the Magisk app
    * Downgrading the banking app (it no longer detects root but locks me out until I upgrade)
    * Cloning the banking app to Work Profile with Shelter (this is the only thing that gets rid of the message about being rooted. But then it bizarrely claims it can't connect to the server to login!?)

    I'm now at a loss as to what else to try. Any ideas please?
    Click to expand...
    Click to collapse
    I have found some banking apps are calling an external site and somehow they are detecting reporting back root. I had an issue with Halifax and Starling before.

    Starling for me tripped over the last few days, and I used pcap droid to trace what hosts it was calling during app start up.

    I found that when i blocked the following address:-

    firebaseremoteconfig.googleapis.com

    it all worked OK.

    Try it if you use Adaway or a DNS provider and add this to your blacklist
    View
    5
    chiteroman
    chiteroman
    Guys, I know what happen. Starling detect resetprop utility, if you set any prop using that Starling will detect it. Hopefully I used magiskboot and modify cmdline to patch ro.boot.verifiedbootstate and ro.boot.flash.locked.
    (I'm using stock Indo rom for vayu with modified super.img and now boot.img).

    Now I lost root, I will root again and I will see.

    After my research I have discovered that it detects Starling:

    - Detect any Zygisk including Magisk Delta and Magisk Alpha, Shamiko doesn't help.
    - Detect resetprop utility, any module using this Magisk tool will be detected.
    - Detect su binary.

    - It does NOT check Play Integrity neither SafetyNet, you can fail Device integrity (CTS profile) and app can work.
    - It does NOT check sensitive properties (like ro.boot.verifiedbootstate and ro.boot.flash.locked).
    - It does NOT check patched images (as someone said earlier).
    View
    3
    tiennhu89
    tiennhu89
    Try hide root with some google apps on deny list. (u can search "html", "webview", "feedback" then enable hide them all apps which include these words.
    View
    3
    giociampa
    giociampa
    What we appear to have at the moment is a conflict between the old and new protection mechanisms...

    ...some apps rely on SafetyNet, so the USNF module (and thus Zygisk) is needed to hide root.

    ...others like Starling have moved on from SafetyNet and/or can detect Zygisk so MagiskHide is required.

    Until such time as the SafetyNet API is removed entirely, then we're going to have some apps that only work in one case (but not the other) ... pretty much the worst of all worlds...
    View
    3
    chiteroman
    chiteroman
    .
    View

New posts