[Discussion] Magisk - The Age of Zygisk.

[zgfg]

Yes I appreciate that. I guess my question was if it is correct that after reboot USNF deselects the gms and gms.unstable

Thanks for the explanation.

FYI found what was triggering the app and got it working. Before I had just renamed Magisk (I renamed to MagicApp if that matters) but that didn't work. Also "pausing" the app wasn't enough.
I needed to actually uninstall the Magisk Manager app itself.

So the mechanism being used by the other app wasn't looking for Magisk/SU, but the app iself.
The App failing doesn't have any local file permissions so must've been something else.

Actually I found two apps failing root check and both were resolved by uninstalling the (renamed) Magisk APK.

So I wondered if the app was simply listening to debug messages.
So I reinstalled and then reproduced the failure looking into ADB logcat.

I could see during opening and just before the protection was triggered logcat events against the ".Magisk" app related to denying access. Uninstalling Magisk app stopped those messages and then the app was able to start.

Should Magisk "hiding" the magisk manager app by renaming it from ".Magisk" also have relabelled all of the messages and such related to the app?

There were similar discussions in the Magisk General Thread. For that cases, it turned out that hiding Magisk app (it does not need to be repackaged/renamed/"hidden' from the Magisk app itself) worked out by using Hide My Apps:
- you need Zygisk LSPosed (Magisk module)
- then Hide My Apps (LSPosed module)

And then you need to configure in HMA - not easy and short to explain

And hiding by HMA really works also for other purposes like detaching YouTube from Playstore (bcs root Vanced YT requires specific old YT version that must never be updated) and similarly for detaching AndroidAuto (Google allows only navigation and various messages - and only through voice control; if you want to write mails or watch YT or Netflix on the car entertainment screen even when you park the car, you need particular old AA version, because only then custom apps for AA like CarTube, Fermata, Screen2Auto, AAMirror can work - otherwise AA block them).
And (only) HMA turned so far to be reliable option for A12, for properly detaching AA from PlayStore, for the purpose as above

 

[HippoMan]

This is a discussion and help thread for the newer versions of Magisk.​

I am *extremely* happy that we finally have a separate thread for this!

 

[pndwal]

Yes I appreciate that. I guess my question was if it is correct that after reboot USNF deselects the gms and gms.unstable

Thanks for the explanation.

FYI found what was triggering the app and got it working. Before I had just renamed Magisk (I renamed to MagicApp if that matters) but that didn't work. Also "pausing" the app wasn't enough.
I needed to actually uninstall the Magisk Manager app itself.

So the mechanism being used by the other app wasn't looking for Magisk/SU, but the app iself.
The App failing doesn't have any local file permissions so must've been something else.


Actually I found two apps failing root check and both were resolved by uninstalling the (renamed) Magisk APK.

So I wondered if the app was simply listening to debug messages.
So I reinstalled and then reproduced the failure looking into ADB logcat.

I could see during opening and just before the protection was triggered logcat events against the ".Magisk" app related to denying access. Uninstalling Magisk app stopped those messages and then the app was able to start.

Should Magisk "hiding" the magisk manager app by renaming it from ".Magisk" also have relabelled all of the messages and such related to the app?

Not sure if it's actually debug massages, but good analysis... You could say which bank / app you're using!...

Bank apps / devs requiring TEE are resorting to more and more clever tricks to detect / indicate a modified execution environment due to lack of confidence in SafetyNet API for obvious reasons.

It seems many are following Sparkasse banks S-PushTAN trick to detect even hidden / obfuscated Magisk app now as use of this app is universal w/ Magisk root.

Detecting applist should be prevented in theory since Android 11, but in practice some are still able to do this using some trickery, eg using Intent queries instead of API requests. Also, some like Sparkasse bank S-PushTAN can detect the hidden ('fully obfuscated") Magisk App by detecting the classes.dex code which does not change (unlike the package name) and can be used to identify the app. Their protection engine (Promon) seems to employ simple pattern matching on installed apps.

I was able to properly hide the already 'hidden' Magisk app (with Intent query hiding set) from S-PushTAN (and it would load) by using Hide My Applist LSPosed module. Hiding the unhidden app this way doesn't work (can app find package name etc even with HMA set?).

I have since discovered LSPosed HMA solution is no longer working for S. PushTAN since 3.5.2 on my MIUI device:
https://github.com/topjohnwu/Magisk/issues/1084#issuecomment-1013811582

Other MIUI users report report the same problem, but users of non MIUI
devices found PushTAN detects more apps but they could still subvert the detection simply by adding HMA app itself and other apps they used (GameGuardian etc) to HMA 'apps invisible' list for S. PushTAN. See issue thread above... PW

 

[pndwal]

Incidentally, it would be very helpful to this effort if other MIUI users could try to bypass Sparkasse banks S-PushTAN app's detection and report. See post above. PW

 

[crypticc]

Not sure if it's actually debug massages, but good analysis...

Bank apps / devs requiring TEE are resorting to ......

great info thank you.

There were similar discussions in the Magisk General Thread.....

Thank you both and thanks for the additional info. I had gotten as far as downloading Shamiko and LSPosed. I even added Shamiko to give it a whirl but it seemed to behave similarly to what Magisk deny + USNF were doing - although maybe I missed something as GPlay and YASNC told me I lost authentication/CTS. Probably I just didn't clear data out of enough google apps.

LSPosed seemed like a whole new rabbit hole to go down so I'd skirted that but I will follow the breadcrumb trails you've set out for me.

Anyhow, for now I'm up and running and I now consider myself better informed so thanks again

 

[zgfg]

Incidentally, it would be very helpful to this effort if other MIUI users could try to bypass Sparkasse banks S-PushTAN app's detection and report. See post above. PW

If you were provoking me, ok I tested again. Did everything as maybe a month ago when S-PushTAN did not detect root on my phone

I installed S-PushTAN, and before opening:
- enabled DenyList and added S-PushTAN to DenyList
- disabled DenyList (because I use Shamiko)
- in HMA, under Select Effective Apps, opened S-PushTAN, enabled Hide, checked: BlackList, All hide methods and applied my template (list of apps that S-PushTAN must not see) where I list Magisk app and all my LSPosed modules.
I do not list LSPosed itself in the template because I use their 'parasitic' method (delete LSPosed app and create a shortcut instead)

Then I rebooted and opened S-PushTAN but this time it redirected me to the browser, complaining about unsecure phone/root

Still, it should be possible: to uninstall S-PushTAN, find on ApkMirror the older version of S-PushTAN (for whom hiding Magisk app by HMA worked), and configured everything for that older version of S-PushTAN

Then additionally to detach (=hide, again by HMA) S-PushTAN from Google Play, to prevent bothering about updates availability.
Hoping that the bank will not block that older version of S-PushTAN soon

I'm not going to push the envelope since I don't really need S-PushTAN

 

[pndwal]

If you were provoking me, ok I tested again.

Please be assured that I make every effort not to provoke you.

Did everything as maybe a month ago when S-PushTAN did not detect root on my phone

I installed S-PushTAN, and before opening:
- enabled DenyList and added S-PushTAN to DenyList
- disabled DenyList (because I use Shamiko)
- in HMA, under Select Effective Apps, opened S-PushTAN, enabled Hide, checked: BlackList, All hide methods and applied my template (list of apps that S-PushTAN must not see) where I list Magisk app and all my LSPosed modules.
I do not list LSPosed itself in the template because I use their 'parasitic' method (delete LSPosed app and create a shortcut instead)

Then I rebooted and opened S-PushTAN but this time it redirected me to the browser, complaining about unsecure phone/root

Same results here despite throwing whole kit and caboodle at HMA apps invisible list... Have a feeling PTAN now detects something in addition to apps... some isolated process leak unique to MIUI?

Still, it should be possible: to uninstall S-PushTAN, find on ApkMirror the older version of S-PushTAN (for whom hiding Magisk app by HMA worked), and configured everything for that older version of S-PushTAN

Then additionally to detach (=hide, again by HMA) S-PushTAN from Google Play, to prevent bothering about updates availability.
Hoping that the bank will not block that older version of S-PushTAN soon

I'm not going to push the envelope since I don't really need S-PushTAN

Yup, a downgrade may be best option for German MIUI users...

My purpose however is simply to determine what extra hiding may be needed for MIUI as opposed to other devices since others don't seem to have this difficulty... I suspect it is likely related to extra traces detected by MOMO for MIUI when it works... Momo is broken (crashes) for me w/ Zygisk & MOMO hidden ATM.

Thanks for confirming this method is not working for you either... I think you have Android 11; I have 10, so confirms it's not the different API level... Does MOMO work for you?...

Hope to see some fixes in updates to MOMO / Shamiko. Shamiko already hides isolated process w/ always unshare, but seems hasn't overcome MIUI anomalies yet. PW

 

[vandyman]

I am doing the happy dance...
I hope this thread stays on track.
The other General Magisk discussion thread is a mess..

 

[pndwal]

I even added Shamiko to give it a whirl but it seemed to behave similarly to what Magisk deny + USNF were doing...

Well it was produced since USNF to fulfill a completely different need, initially to hide Zygisk and Zygisk modules as these were not hideable initially (just as Riru / Riru modules were detectable until RiruHide was incorporated in Ritu), and later hiding for other indicators of Magisk root and Isolated process leaks (unshare) as well as support for whitelist hide list mode (as existed in deprecated vvb2060 Lite Magisk builds) have been added.
https://forum.xda-developers.com/t/magisk-general-support-discussion.3432382/post-86306355

LSPosed seemed like a whole new rabbit hole to go down so I'd skirted that but I will follow the breadcrumb trails you've set out for me.

Official Zygisk-LSPosed is still not out, but CI builds have worked fine for some time. See artifacts in latest actions here:
https://github.com/LSPosed/LSPosed/actions
or go here:
https://t.me/LSPosedArchives

PW

 

[zgfg]

Please be assured that I make every effort not to provoke you.

Same results here despite throwing whole kit and caboodle at HMA apps invisible list... Have a feeling PTAN now detects something in addition to apps... some isolated process leak unique to MIUI?

Yup, a downgrade may be best option for German MIUI users...

My purpose however is simply to determine what extra hiding may be needed for MIUI as opposed to other devices since others don't seem to have this difficulty... I suspect it is likely related to extra traces detected by MOMO for MIUI when it works... Momo is broken (crashes) for me w/ Zygisk & MOMO hidden ATM.

Thanks for confirming this method is not working for you either... I think you have Android 11; I have 10, so confirms it's not the different API level... Does MOMO work for you?...

Hope to see some fixes in updates to MOMO / Shamiko. Shamiko already hides isolated process w/ always unshare, but seems hasn't overcome MIUI anomalies yet. PW

Momo does not crash for me (yes, it is listed in DenyList).

And it works, actually 'better' than ever before - it detects everything as on the screenshot

-I still run the same Xiaomi.eu A11 (no more upgrades for my phone)
- same Momo 4.0.1 as before

- Newer Magisk Alpha (latest 24001), newer Shamiko (latest 73) and the latest by one LSPosed

And what was improved?

Actually, to the contrary - Momo now detects one more item "Found Magisk" that was not detected like two months or so ago

(For others:
Please don't start teaching me that I need this or that. I wasted a lot of time on Momo long ago and tried everything that you would advise me now

And I don't want to get involved now into discussions about the background: MIUI, odex vs deodex ROMs, etc

But I don't really care about Momo and its detections - I have already frozen the Momo back, let it sleeps for the long winter)

 

[pndwal]

Momo does not crash for me (yes, it is listed in DenyList).

And it works, actually 'better' than before - it detects everything as on the screenshot

-I still run the same Xiaomi.eu A11 (no more upgrades for my phone)
- same Momo 4.0.1 as before

- Newer Magisk Alpha (latest 24001), newer Shamiko (latest 73) and latest by one LSPosed

And what was improved?

Actually, to the contrary - Momo now detects one more item "Found Magisk" that was not detected like two months or so ago

Yup, it was similar for me when I could see results. (Broke with 72 Shamiko)...

Suspect something in MIUI allows detection of Magisk / Unlocked bootloader as other devices evade these... Possibly Magisk one is the culprit if you're correct about it being newly found; I don't recall... PW

 

[VD171]

Any magisk hider, please?
Edit: About how hiding root actually?
I've installed Magisk v24.1, LSPosed v1.7.2, Shamiko v0.4.3, XPrivacyLua v1.30 and everything is working perfectly.
I can hide root, xposed and zygisk, using it, please read my reply:

[APP][v1.10] VD Infos (Package: com.vitaodoidao.vdinfos)

(Para quem fala PORTUGUÊS, o próximo post está totalmente traduzido !) VD Infos v1.10 As we all know, Android is a super powerful and super versatile operating system. What nobody tells you is that all your personal details and confidential...

forum.xda-developers.com

 

[zgfg]

Yup, it was similar for me when I could see results. (Broke with 72 Shamiko)...

Suspect something in MIUI allows detection of Magisk / Unlocked bootloader as other devices evade these... Possibly Magisk one is the culprit if you're correct about it being newly found; I don't recall... PW

Magisk General thread, Dec 6, post #49346:
https://forum.xda-developers.com/t/magisk-general-support-discussion.3432382/post-86055073

On the screenshot you can see that "Found Magisk" was not present

At that time I was running Alpha 23015 and some earlier versions of Shamiko and LSPosed. All the rest regarding Magisk, modules, LSPosed and its modules, root apps was the same

 

[pndwal]

Magisk General thread, Dec 6, post #49346:
https://forum.xda-developers.com/t/magisk-general-support-discussion.3432382/post-86055073

On the screenshot you can see that "Found Magisk" was not present

At that time I was running Alpha 23015 and some earlier versions of Shamiko and LSPosed. All the rest regarding Magisk, modules, LSPosed and its modules, root apps was the same

Yup; ... But seems I had both bootloader and Magisk detection then... thanks for reminder... perhaps nothing has changed w/ miui since Zygisk; just better PushTAN detection... Good to see the girls club working on improving Shamiko hiding though... PW

 

[dohanin]

sorry, maybe i have missed, but how did you hide unlocked bootloader?
Momo and Key Attestation (both from vvb2060) detects it while other detections are successfully hidden.

A12+magisk canary zygisk+shamiko+usnf

 

[pndwal]

sorry, maybe i have missed, but how did you hide unlocked bootloader?
Momo and Key Attestation (both from vvb2060) detects it while other detections are successfully hidden.

A12+magisk canary zygisk+shamiko+usnf

That's what we've been discussing; seems USNF / Shamiko combination works as advertised for many devices (USNF hides enough to 'fix' SafetyNet, Shamiko hides more signs of unlocked bootloader, Magisk etc properly). Some seem to be able to achieve completely 'happy Momo' (MOMO detector says 'Environment is normal' / detects nothing suspicious) on some devices, eg RealMe.

With MIUI (Xiaomi) on the other hand, this seems difficult; we get a number of detections. I haven't been able to hide unlocked bootloader or Magisk from MOMO with Zygisk, although both Rootbeer Fresh and Rootbeer Sample detect nothing. PW

 

[Eng.Raman]

Not sure if it's actually debug massages, but good analysis... You could say which bank / app you're using!...

Bank apps / devs requiring TEE are resorting to more and more clever tricks to detect / indicate a modified execution environment due to lack of confidence in SafetyNet API for obvious reasons.

It seems many are following Sparkasse banks S-PushTAN trick to detect even hidden / obfuscated Magisk app now as use of this app is universal w/ Magisk root.

Detecting applist should be prevented in theory since Android 11, but in practice some are still able to do this using some trickery, eg using Intent queries instead of API requests. Also, some like Sparkasse bank S-PushTAN can detect the hidden ('fully obfuscated") Magisk App by detecting the classes.dex code which does not change (unlike the package name) and can be used to identify the app. Their protection engine (Promon) seems to employ simple pattern matching on installed apps.

I was able to properly hide the already 'hidden' Magisk app (with Intent query hiding set) from S-PushTAN (and it would load) by using Hide My Applist LSPosed module. Hiding the unhidden app this way doesn't work (can app find package name etc even with HMA set?).

I have since discovered LSPosed HMA solution is no longer working for S. PushTAN since 3.5.2 on my MIUI device:
https://github.com/topjohnwu/Magisk/issues/1084#issuecomment-1013811582

Other MIUI users report report the same problem, but users of non MIUI
devices found PushTAN detects more apps but they could still subvert the detection simply by adding HMA app itself and other apps they used (GameGuardian etc) to HMA 'apps invisible' list for S. PushTAN. See issue thread above... PW

Incidentally, it would be very helpful to this effort if other MIUI users could try to bypass Sparkasse banks S-PushTAN app's detection and report. See post above. PW

The latest play store version of S-pushTAN 3.5.2 works well on my phone using Magisk Canary Beta 24.0 and HMA LSPosed module.

 

[pndwal]

The latest play store version of S-pushTAN 3.5.2 works well on my phone using Magisk Canary Beta 24.0 and HMA LSPosed module.

Thanks! ... Guess you have public Beta if 24.0. (The debug logging enabled synchronised Canary version is 24001.)

Please remind me what phone you have; MIUI OS that appears to have issues with HMA method now while other devices / OSs can pass easily. Also, can you show us Momo screenshot? PW

 

[Eng.Raman]

Thanks! ... Guess you have public Beta if 24.0. (The debug logging enabled synchronised Canary version is 24001.)

Please remind me what phone you have; MIUI OS that appears to have issues with HMA method now while other devices / OSs can pass easily. PW

My phone details in my signature ( + installed LSPosed zygisk variant with 11 modules / 4 magisk modules: busybox, Enhance mode for HMA, Shamiko Mod, and Zygisk-LSPosed ).

 

[Eng.Raman]

Also, can you show us Momo screenshot? PW