• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

HiddenCore Module - what was it doing

Search This thread

nri_tech1183

Senior Member
Jan 4, 2015
492
41
Thanks dear, it worked, now I can use xposed along with banking apps. Can I remove the security patch module from magisk manager? View attachment 4878693

Sent from my ASUS_X01BDA using Tapatalk

Hi guys I'm on redmi note 7 pro rooted.
All is working good magisk etc and no safetynet issue.
* Already got SafetyPatch-v3 installed and working fine.

I tried installing edxposed by following this thread...
http://forum.xda-developers.com/xposed/android-9-0-xposed-solutions-t3889513

After reboot my whatsapp got deleted automatically.

Magisk status: cts and basic integrity: false.

On every reboot some random app is getting vanished from my device.
Dont know why this behavior.
Uninstalled EdXposedManager-org.meowcat.edxposed.manager-4.5.2-452-release.apk

and cts and basic integrity: false.True

But still phone behaving crazy.. in locked state phones battery went down from 71 to 25% and phone was warm as well. battery stats showed no unusual behavior.

Tried EdXposedUninstaller.zip and while flashing twrp gives error:
Magisk is not installed!
Magisk is required for this mod!


Also, trying to flash same zip via magisk it says,

This zip is not magisk module
installation failed!!



I want to enjoy edxposed with magisk and safetynet pass. I want to use few xposed modules hence the urge/ necessity.


  1. Please guide me to first uninstall edxposed completely from my system so I can start afresh.

  1. Then tell me the exact steps to install edxpoed etc. and then do I need to install this HiddenCore Module_com.cofface.invader.apk
  2. Or should I follow these steps directly https://github.com/ElderDrivers/EdXposed/issues/386
 
Last edited:

nice_guy75

Senior Member
Mar 29, 2012
297
73
Hi guys I'm on redmi note 7 pro rooted.
All is working good magisk etc and no safetynet issue.
* Already got SafetyPatch-v3 installed and working fine.

I tried installing edxposed by following this thread...
http://forum.xda-developers.com/xposed/android-9-0-xposed-solutions-t3889513

After reboot my whatsapp got deleted automatically.

Magisk status: cts and basic integrity: false.

On every reboot some random app is getting vanished from my device.
Dont know why this behavior.
Uninstalled EdXposedManager-org.meowcat.edxposed.manager-4.5.2-452-release.apk

and cts and basic integrity: false.True

But still phone behaving crazy.. in locked state phones battery went down from 71 to 25% and phone was warm as well. battery stats showed no unusual behavior.

Tried EdXposedUninstaller.zip and while flashing twrp gives error:
Magisk is not installed!
Magisk is required for this mod!


Also, trying to flash same zip via magisk it says,

This zip is not magisk module
installation failed!!



I want to enjoy edxposed with magisk and safetynet pass. I want to use few xposed modules hence the urge/ necessity.


  1. Please guide me to first uninstall edxposed completely from my system so I can start afresh.

  1. Then tell me the exact steps to install edxpoed etc. and then do I need to install this HiddenCore Module_com.cofface.invader.apk
  2. Or should I follow these steps directly https://github.com/ElderDrivers/EdXposed/issues/386
It's because Busybox module. Uninstall that module.

Sent from my ASUS_X01BDA using Tapatalk
 

nri_tech1183

Senior Member
Jan 4, 2015
492
41
Look at the screenshot Busybox module is installed in the magisk, I myself tried it, it did the same thing with my contact app, my contact app vanished after installing busybox module.

Sent from my ASUS_X01BDA using Tapatalk

What screenshot you referring to?

Right now I've formatted my phone and flashed new rom with all stock apps.

As soon as I install Magisk (no edxposed), the phone is loosing battery when its in pocket and is getting warm due to excessive battery drain. If phone isn't in pocket the battery seems ok and phone also isn't warm.

Double tap to Wake/Sleep is disabled.
No battery draining observed by any apps.
 
Last edited:

nice_guy75

Senior Member
Mar 29, 2012
297
73
What screenshot you referring to?



Right now I've formatted my phone and flashed new rom with all stock apps.



As soon as I install Magisk (no edxposed), the phone is loosing battery when its in pocket and is getting warm due to excessive battery drain. If phone isn't in pocket the battery seems ok and phone also isn't warm.



Double tap to Wake/Sleep is disabled.

No battery draining observed by any apps.
See the screenshot which you uploaded in your first reply.

Sent from my ASUS_X01BDA using Tapatalk
 

hockeymikey

Senior Member
This helps to pass safetynet but doesn't work with verified responses. Like with Snapchat, it still doesn't work to login. I am using microG too, and safetynet is broken with it too, so that probably has a lot to do with it. Checking out the source, it seems clean. Only issue is there a part in there disabling sleep at certain times, something I personally don't want at all. I'll work on compiling the module for myself and then releasing the source and an edited apk sometime.
 

mario0318

Senior Member
I can confirm running HiddenCore 1.7 on Lineage 15.1 passes both Safetynet ctsProfile and basicIntegrity, at least on magisk (20.1).

Google Pay works for me. The only thing that doesn't is setting up NFC which seems to detect its a rooted phone, even with magiskhide enabled and the app checked on. But since i dont really need that feature, the rest of Google Pay like the wallet and digital cards, sending and receiving payments, linking to other services (Venmo, PayPal) works just fine.

I don't have snapchat and I haven't bothered with it in a while from their stupid restrictive anti-root check that's way too much a pain in the butt to set up, not to mention the app is way too resource hungry.

My only issue which has been noted is the Always On display. I finally got to learn what the hell was causing my screen to not go off on the home screen and within certain apps, yet display goes to sleep with no problem when some apps are open on screen. I can live with that. But I really wish there was a way to prevent it without downgrading to HiddenCore 1.3. Btw, Adguard shows no data ever going through this mod so I think it's pretty safe to install.
 

Light_Wing

Senior Member
Aug 5, 2019
53
3
I got here because of the screen problem, after narrowing down the suspect, it was this module, as for me, at least it make the magisk check marks green...

Other then the screen not going off automatically I also saw that it was messing with some certificates for browsing, I wasn't able to connect to the Xposed repo (I got a "ERR_SSL_VERSION_OR_CIPHER_MISMATCH" error) and after disabling it, I'm able to connect normally...

I saw someone said this module isn't there anymore, but on my end, I can still see it's there
https://repo.xposed.info/module/com.cofface.ivader
Also, if you see the link they put for support, it says XDA without the developers part, and it redirects you through some ads and stuff, so another suspicious fact...

Anyway, I've disabled it, I don't really need it, for my bank, I just added the back app to the magisk hide list, and it seems to work, and I don't really care if I get cts profile and basic integrity as red check marks... Though if someone has a way around it I'm open for suggestions
 

RootedLee

Senior Member
Sep 1, 2017
222
44
Suspect indeed..

Anybody has any experience with Diwa, Dotmod or any other module instead?

Mind that ALL, Diwa, HiddenCore Module and Dotmod are CLOSED source..

Is there any open source app or module to hide Xposed from an app?
 
Last edited:

hockeymikey

Senior Member
Suspect indeed..

Anybody has any experience with Diwa, Dotmod or any other module instead?

Mind that ALL, Diwa, HiddenCore Module and Dotmod are CLOSED source..

Is there any open source app or module to hide Xposed from an app?

Here's the source for HiddenCore: https://github.com/hockeymikey/HiddenCore
Eventually I'll be working on building it independently (probably rebranding too) and changing some stuff like adding a UI to disable the wake lock crap keeping devices on.
 
  • Like
Reactions: mr3p and Jarras

RootedLee

Senior Member
Sep 1, 2017
222
44
Here's the source for HiddenCore: https://github.com/hockeymikey/HiddenCore
Eventually I'll be working on building it independently (probably rebranding too) and changing some stuff like adding a UI to disable the wake lock crap keeping devices on.
very neat, thank you Mike. By "independently", do you mean not requiring Xposed anymore? Esp. for hiding apps from Xposed, that seems to make most sense to me, because that feature does not have any effect on the PayBack app if enabled in any mentioned Xposed module.

On this phone I'm stuck with Android Nougat 7.1.1 for now, therefore no EdXposed (for Android 8.+) with a built in blacklist option to hide apps from Xposed.

If you want a stubborn test candidate/ guinea pig to unleash your rework of HiddenCore onto: https://play.google.com/store/apps/details?id=de.payback.client.android :) Mind that pre-requisite for the Xposed test is to hide it from root via Magisk Hide.
 

Swierk

Senior Member
May 25, 2011
113
17
Version 1.7 actually worked perfectly with Magisk 20.3, Riru EdXposed 0.4.6.1 (4510) and Riru Core 19.7 - hides Xposed perfectly - I made a payment in shop! :)

As I sad... worked... because 1.7 was messing with screen Always On and decided to try 1.3 because it was claimed here that bug not exist in 1.3. True. Screen became turn off as it should but SafetyNet from that moment didn't pass :(

I revert back to 1.7 but now with no luck - don't pass SafetyNet :(

Tried:
- Uninstall and install 1.7
- When you switch off Riru EdXposed with turned on HiddenCore SafetyNet pass OK but when you enable EdXposed again with HiddenCore already on, SafetyNet fail :(
- gpay-gms-patch.sh - script that helped me add cards successfully to GPay

So please help guys to revert back to working 1.7 even with screen always on! I really count on you!

Sent from OnePlus 7 Pro, OxygenOS 10.0.3, TWRP 3.3.1-75, Magisk 20.3, EdXposed 0.4.6.1 (build 4510), Modded Play Store 16.5.15, android core.java patched and SafetyNet pass OK
 
Last edited by a moderator:

Evengard

Senior Member
Dec 19, 2009
261
94
Here is the module but without the "always on screen".
All I did was took the original module, baksmalied it, found the switch for the screen always on, patched so it would be always false, smalied back and resigned. Of course you shouldn't trust me, so you can do it by yourself.

UPD: Forgot to say, that if you have the original module installed, you should remove it first, or else there is a high chance that the install will fail because of mismatched signatures.
 

Attachments

  • base4.apk
    206.3 KB · Views: 2,998
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 43
    Here is the module but without the "always on screen".
    All I did was took the original module, baksmalied it, found the switch for the screen always on, patched so it would be always false, smalied back and resigned. Of course you shouldn't trust me, so you can do it by yourself.

    UPD: Forgot to say, that if you have the original module installed, you should remove it first, or else there is a high chance that the install will fail because of mismatched signatures.
    11
    Found this module, although it didn't look too legit, I thought if it does what it really says it does then it would be very useful (bypass safetynet, disable all root detection, selinux, bypass signature verification etc) so i installed it.

    Anyway now I see its been removed from the repository. I'm guessing it was not legit after all, anyway other than decompiling the apk file to see what it was doing, is there anyway to find out why it was removed and what potential damage/data has been done to my device?


    Edit, the link: https://repo.xposed.info/module/com.cofface.invader
    6
    I actually used this code as reference when was searching for the switch in the smali. The line in question is
    Code:
    systemwideScreenOn = prefs.getBoolean("systemwide", true);
    (link) - you just gotta need to replace it with
    Code:
    systemwideScreenOn = false;

    And no, I saw nothing about Chrome, but the hooks seems to be too wide, hooking a little bit more than really is needed, so that may be the case.

    I'm not using Chrome though, prefering Firefox, so can't say.
    3
    I was wondering this as well. I had and it was gone. Have yet to find another one that allows full safteynet pass. Wonder why it was removed

    I suspect it wasn't actually doing anything it claimed to do. I noticed my screen was staying on for some reason, then I realised it was caused by that app. I was a bit concerned it was actually a RAT or some malware sending off all my private data somewhere.

    If I get time this weekend I might try decompile it and have a look I still have the apk file, have just disabled it in xposed.
    3
    Interesting, I must say.
    Read the whole thread in one sitting, it was better than any thing oh Netflix right now.
    And about GPay, freaking evil mothaeffers, I've always thought they were so totally being meme if you will, about that permission for pay...
    @Didgeridoohan, what's your take on what's discussed hehe? I believe there would be awesome benefiting from your knowledge.

    Honestly, not sure... Lots of conflicting info on the thread, so really hard to say anything and I'm not gonna install Xposed just to test.

    But, I'm a bit paranoid by nature and my spider sense is tingling slightly. Personally I would be careful...