Hide My Applist - A Brief Guide

[pndwal]

Re.

73sydney​

Account currently disabled​

and

Please note:

I will no longer be participating in this thread, or forum, and therefore there will be no further updates by me to the guide.

Very much hope this changes after a few nights of proper sleep mate... Wouldn't be the same here without you.

All best, PW...

 

[mrjuniork]

Ah...

Interesting traditional Sammy shell vuln/exploit project here:
https://forum.xda-developers.com/t/...mobile-devices-no-bl-unlock-required.4543071/

Sorry if OT... PW

It's definitely OT, but let's wait and see what the thread owner has to say, once being back with a snatch of sleep

 

[Beefheart]

Followed instructions but no matter what I do I can't get the Santander UK app working, it immediately tells me its closing the app for my own safety.

 

[martyfender]

Followed instructions but no matter what I do I can't get the Santander UK app working, it immediately tells me its closing the app for my own safety.

I am located in the USA. I downloaded both the Santander US app and the Santander UK app. With the US app I can get to the login screen just fine. However with the UK app I get the same result as you. My wild guess is this is because of the EU's stricter requirement, but I am just speculating here.

 

[bombadier]

Followed instructions but no matter what I do I can't get the Santander UK app working, it immediately tells me its closing the app for my own safety.

Im in the uk and just tried the Santander mobile app, at what point does the app close for you? I can get to the login screen but am not a customer so cannot go further, check your config, i added santander to the deny list in magisk and added it to hide my applist and it seems to work as far as login

 

[Beefheart]

Im in the uk and just tried the Santander mobile app, at what point does the app close for you? I can get to the login screen but am not a customer so cannot go further, check your config, i added santander to the deny list in magisk and added it to hide my applist and it seems to work as far as login

This now works now I've blocked it in Magisk, cheers . The instructions in the OP states not to do this unless I misread them.

I have had it working previously but it stops after a few days. Hopefully that isn't the case here.

 

[zgfg]

This now works now I've blocked it in Magisk, cheers . The instructions in the OP states not to do this unless I misread them.

I have had it working previously but it stops after a few days. Hopefully that isn't the case here.

What do you 'block' now?
If it is that banking app, yes, you always have to put it to the Denylist (or MagiskHide if you use Magisk Delta)

No guide should say the opposite.
If the guide says that you should not Enforce DenyList when using Shamiko, it doesn't mean that the banking app should not be checked in the Denylist (in that case Shamiko will process DenyList and that's again the reason why 'banking' apps must be in DenyList)

 

[martyfender]

Im in the uk and just tried the Santander mobile app, at what point does the app close for you? I can get to the login screen but am not a customer so cannot go further, check your config, i added santander to the deny list in magisk and added it to hide my applist and it seems to work as far as login

I tried this on my second Onn 8 1st gen. with Magisk Delta with both zygisk and magisk hide turned on and the app works on it.

 

[bombadier]

I tried this on my second Onn 8 1st gen. with Magisk Delta with both zygisk and magisk hide turned on and the app works on it.

Good to know, i had a problem with the halifax app a while ago and tried delta with hide but it didnt work for me, tried hidemyapplist and had success so have stuck with it

 

[wipeyourbuttocks]

This did not work for the app TNG eWallet. Idk if it's detecting any systems apps from LOS.

 

[martyfender]

Good to know, i had a problem with the halifax app a while ago and tried delta with hide but it didnt work for me, tried hidemyapplist and had success so have stuck with it

I spoke too soon. After a day or so, the Santander UK app detected root. And to top that off, that app would launch every time I launch the Magisk app and maybe when I launched some other (maybe root?) apps. It got so annoying that I uninstalled the Santander UK app. I don't have an account for it here in the USA, only an auto loan account with the here. By the way, the Santander US app never detects root, Yet, but I will eventually uninstall it to I can't access my auto loan through that app.

 

[oliversum]

Google Wallet suddenly detects root and doesn't allow NFC payments anymore. Did someone figure out proper settings for Google Wallet?

 

[zgfg]

Google Wallet suddenly detects root and doesn't allow NFC payments anymore. Did someone figure out proper settings for Google Wallet?

HMA won't help for Wallet

Look to the corresponding reports about issues with Wallet in the Google Pay Magisk thread, Universal Safety Net Fix thread, Play Integrity API thread, maybe it was also mentioned in the Magisk General thread

 

[73sydney]

Please see OP for new home of the HMA Guide

It has moved for several reasons, not least to make it easier to keep up to date

Cheers

 

[m0han]

... i'm no longer active on XDA,.... sorry folks...​

At least you're NOT 'Account currently disabled'. Welcome back, mate.

 

[BYRMN13]

Hi There! Could someone help me with this issue, I just install hide my applist in my new phone but it seems something is wrong this time, cause I cannot see any app in applied apps section in templete setting, I don't have any idea how to fix this issue, please help, thank you in advance.

Edit: NVM, I forgot to select app in deny list. :')

 

[TraderJack]

Hey. So this seem like a nice guide for those who have no idea how to set this up.

I just came across it because I started getting Root notifications on my Citibank app (actually I don't know if I was getting them before or not, I only use it once every couple of months and despite the notifications, my needed functionality does not seem to be impacted).

In any event, I thought updating HMA/Zygisk, etc might help with hiding from Citi, and when that didn't I found this guide in hopes that maybe there was a setting I was overlooking.

I'm a bit confused by this guide's complexity. Not that it is hard to follow, but the recommendations for the template and the blacklisting of all the magisk, xposed, etc apps.

The reason I say this is that instead of running HMA with apps in "Blacklist" mode and applying a template of blacklisted applications, I have always run HMA apps using the "Whitelist" option. This effectively means that ALL apps are hidden from the application unless you specify them (either individually or with a whitelist template).

I have a specific app: STC Pay, which I don't actually use myself but know that it is a very problematic app for some and I use it as a "test" app. This app won't run (constantly crashes within 5 seconds of use) when setting up HMA according to this guide. If instead you configure the app in "Whitelist" mode as I've described it appears to work fine.

That being said, getting all OK checkboxes in Applist Detector doesn't seem to necessarily be a good indicator. For instance, when using this guide I get 100% all checkboxes in Applist Detector, but STC Pay (configured the same way) fails to run. If I set it up my way, AppList still shows a "suspicious" on "PM Intent Queries" (unless you also choose the option in HMA to hide system apps...which also seems to work fine).

IOW, passing the checks on AppList Detector (or similar) does not seem to be the best indicator that things are working as you want, since I can pass all them with this guide but my apps fail to run (because they seemingly detect root and/or other harmful apps).

So, I'm curious, both from @73sydney and other users why the choice to use the settings in this guide rather than simply choose use Whitelist mode which, at least in my experience, works on a wider range of apps AND seems less complex to setup.

FWIW, in no configuration can I get Citibank to not detect root, but luckily for now at least it seems mostly an information message as I can continue to use the app (although it does seem if I setup Biometrics that logins will fail, even if using password attempt).

UPDATE: My Citibank was being detected because it somehow (probably on update) got (partially) removed from the Magisk Deny List.

If I could suggest one update to the @73sydney his guide should be a bit clearer in regards to the DenyList. It makes a brief mention of Shamiko with the Deny List. While it is true that "Enforce Deny List" needs to be toggled "OFF", this does not mean that the DenyList is not in use. You STILL NEED to add the apps that you want to hide from Magisk/root to this list it is just that Magisk is no longer capable of enforcing it, instead Shamiko does that. I suspect that at least some people following this guide are not able to properly hide root because the guide is not clear in ensuring that not only are apps configured in HMA, but also still listed on Magisk's DenyList.

 

[crok.bic]

I have always run HMA apps using the "Whitelist" option. This effectively means that ALL apps are hidden from the application unless you specify them (either individually or with a whitelist template).

I second this: I do it with the same method when I see problematic apps && ROMs in my hands and whitelist "method" always works "better" for some reason.

 

[ipdev]

Hey. So this seem like a nice guide for those who have no idea how to set this up.

I just came across it because I started getting Root notifications on my Citibank app (actually I don't know if I was getting them before or not, I only use it once every couple of months and despite the notifications, my needed functionality does not seem to be impacted).

In any event, I thought updating HMA/Zygisk, etc might help with hiding from Citi, and when that didn't I found this guide in hopes that maybe there was a setting I was overlooking.

I'm a bit confused by this guide's complexity. Not that it is hard to follow, but the recommendations for the template and the blacklisting of all the magisk, xposed, etc apps.

The reason I say this is that instead of running HMA with apps in "Blacklist" mode and applying a template of blacklisted applications, I have always run HMA apps using the "Whitelist" option. This effectively means that ALL apps are hidden from the application unless you specify them (either individually or with a whitelist template).

I have a specific app: STC Pay, which I don't actually use myself but know that it is a very problematic app for some and I use it as a "test" app. This app won't run (constantly crashes within 5 seconds of use) when setting up HMA according to this guide. If instead you configure the app in "Whitelist" mode as I've described it appears to work fine.

That being said, getting all OK checkboxes in Applist Detector doesn't seem to necessarily be a good indicator. For instance, when using this guide I get 100% all checkboxes in Applist Detector, but STC Pay (configured the same way) fails to run. If I set it up my way, AppList still shows a "suspicious" on "PM Intent Queries" (unless you also choose the option in HMA to hide system apps...which also seems to work fine).

IOW, passing the checks on AppList Detector (or similar) does not seem to be the best indicator that things are working as you want, since I can pass all them with this guide but my apps fail to run (because they seemingly detect root and/or other harmful apps).

So, I'm curious, both from @73sydney and other users why the choice to use the settings in this guide rather than simply choose use Whitelist mode which, at least in my experience, works on a wider range of apps AND seems less complex to setup.

FWIW, in no configuration can I get Citibank to not detect root, but luckily for now at least it seems mostly an information message as I can continue to use the app (although it does seem if I setup Biometrics that logins will fail, even if using password attempt).

UPDATE: My Citibank was being detected because it somehow (probably on update) got (partially) removed from the Magisk Deny List.

If I could suggest one update to the @73sydney his guide should be a bit clearer in regards to the DenyList. It makes a brief mention of Shamiko with the Deny List. While it is true that "Enforce Deny List" needs to be toggled "OFF", this does not mean that the DenyList is not in use. You STILL NEED to add the apps that you want to hide from Magisk/root to this list it is just that Magisk is no longer capable of enforcing it, instead Shamiko does that. I suspect that at least some people following this guide are not able to properly hide root because the guide is not clear in ensuring that not only are apps configured in HMA, but also still listed on Magisk's DenyList.

I second this: I do it with the same method when I see problematic apps && ROMs in my hands and whitelist "method" always works "better" for some reason.

Hi.

I do not follow HMA that much.
I use it to hide some apps from others using black list(s).

I thought you could mix the two methods.

What happens if you:

- Configure a black list and apply it to the apps that work better with a black list.
- Use white list on the apps that work better with a white list.

Cheers.

 

[TraderJack]

What happens if you:

- Configure a black list and apply it to the apps that work better with a black list.
- Use white list on the apps that work better with a white list.

Cheers.

You can certainly do that.
It's just in my experience HMA is mainly used to hide "offensive" apps (those usually used to modify the device) from other apps that don't want them there.

Usually this is banking apps, but could be games or others.

In every case I've come across these "complaining" apps don't have the need to see *anything* else, and therefore you can simply configure the Whitelist option which effectively blocks them from seeing anything else.

For me, this seems to work better and had the side effect of being more secure as it "fails closed" instead of "fails open."

For instance, using the instructions in this guide, if you install another "offensive" app, you would need to make sure to update your template to exclude this new app.
The way I configure you wouldn't need to do this. It seems much less likely that an app would actually need to know of the existence of another and if there happened to be a use case for that you can simply add that individually to the particular apps' whitelist.

The other option is privacy. For instance, maybe an app like Facebook can access data from another app (even though modern Android os should limit this). In this case you would want to restrict Facebook from seeing all other apps. Once again, I feel the Whitelist option is the better choice.

I'm certainly open to being proven wrong by other use cases...I just don't see them.