Magisk General Support / Discussion

[huskydg]

Mine is a bit different, it's from termux

Termux has wrapper "su" in /data/data/com.termux/files/usr/bin

And this path is in PATH variable

 

[huskydg]

... Just did what @zgfg did for his comparison... However w/ -a, same result:
View attachment 5647487
PW

Because there are only su in /sbin

 

[pndwal]

@zgfg @pndwal

How does hiding root work?
When target app on hidelist / denylist is opened, Magisk will immediately unmount Magisk tmpfs mountpoint, dummy skeleton tmpfs and magisk created mount bind so there are no /sbin/su or /system/bin/su (Android 11+) in target apps.

See the source code:
Denylist unmount: zygisk/deny/revert.cpp
MagiskHide: magiskhide/hide_policy.cpp

Momo is abusing isolated process and app zygote process to bypass MagiskHide and detect Magisk. And the fact that not all banking apps use isolated process or app zygote.

Sure; but fact is many banks do do this (detect mount 'leaks' etc), which is why vvb2060 and other LSP Devs experimented w/ unshare modules, Magisk Lite etc, and why they've incorporated such functionality in Canyie's Shamiko and Magisk Bravo now...

Isn't Momo simply doing whatever Google/ Android allows, just like Bank apps, with the stated purpose:

This app uses correct methods to detect root and Xposed, but the goal is not to against root or Xposed.

By making detection methods public (some methods are private), our goal is to improve user knowledge and force the community to make correct improvements...

Also, this helps modders understand what can (possibly) be detected by bank apps etc... Not sure why such an initiatives by key Magisk / LSP / XHook framework Devs would be considered to be an abuse... PW

 

[huskydg]

fact is many banks do do this (detect mount 'leaks' etc), which is why vvb2060 and other LSP Devs experimented w/ unshare modules

Scanning proc mount leeks is no longer possible on Android 8+ and proc is mounted with hidepid=2 flag

 

[pndwal]

Scanning proc mount leeks is no longer possible on Android 8+ and proc is mounted with hidepid=2 flag

Still, if "abusing isolated process and app zygote process to bypass MagiskHide and detect Magisk" can be done, why is this abuse for Momo where the stated goal is "making detection methods public... to improve user knowledge and force the community to make correct improvements"?...

Isn't the point that if it can be done by Momo, at least some banks will try it? PW

 

[huskydg]

Still, if "abusing isolated process and app zygote process to bypass MagiskHide and detect Magisk" can be done, why is this abuse for Momo where the stated goal is "making detection methods public... to improve user knowledge and force the community to make correct improvements"?...

Isn't the point that if it can be done by Momo, at least some banks will try it? PW

And... Aren't there already 3rd modules that workaround this issues??
Bonus: You can make DenyList to handle isolated process by just adding a small code into zygisk/hook.cpp


// Ensure separated namespace, allow denylist to handle isolated process before Android 11 if (args->mount_external == 0 /* MOUNT_EXTERNAL_NONE */) { // Only apply the fix before Android 11, as it can cause undefined behaviour in later versions char sdk_ver_str[92]; // PROPERTY_VALUE_MAX if (__system_property_get("ro.build.version.sdk", sdk_ver_str) && atoi(sdk_ver_str) < 30) { args->mount_external = 1 /* MOUNT_EXTERNAL_DEFAULT */; } }

 

[pndwal]

And... Aren't there already 3rd modules that workaround this issues??
Bonus: You can make DenyList to handle isolated process by just adding a small code into zygisk/hook.cpp


// Ensure separated namespace, allow denylist to handle isolated process before Android 11 if (args->mount_external == 0 /* MOUNT_EXTERNAL_NONE */) { // Only apply the fix before Android 11, as it can cause undefined behaviour in later versions char sdk_ver_str[92]; // PROPERTY_VALUE_MAX if (__system_property_get("ro.build.version.sdk", sdk_ver_str) && atoi(sdk_ver_str) < 30) { args->mount_external = 1 /* MOUNT_EXTERNAL_DEFAULT */; } }

Just like Canyie's Bravo Magisk I mentioned?
Allow denylist to handle isolated processes before Android 11
canyie committed on 4 Apr...

...Just care what can/can't be done... to much misinformation here already... PW

 

[vMAC]

So currently I have Magisk installed on my phone. I also have a Work Profile with Intune setup. The problem is that it restricts my ability to install apps from "unknown sources." So with the last update to Magisk Canary I keep getting the alert that I need to update. I currently have Magisk hidden also, so it doesn't come up with the Magisk name.

I connected my computer to my phone and did a "adb install magisk.apk" for the canary app. The problem is that after doing this, while it states that it was successful, the app still says that I need to upgrade the app.

Can someone help me? What am I doing wrong?

I hope the answer isn't that I need to uninstall Intune every time I want to upgrade Magisk.

 

[zgfg]

You should use which -a su to see all the directories in your path containing su, not just the first one.

which -a su
/system/bin/su

Momo detecting su in the path

Magisk Canary 25101 with DenyList Unmount (not Shamiko).
Momo in DenyList, DenyList not enforced

@pndwal how to inspect is it 2SI device

 

[zgfg]

...The problem is that it restricts my ability to install apps from "unknown sources."

I connected my computer to my phone and did a "adb install magisk.apk" for the canary app. The problem is that after doing this, while it states that it was successful, the app still says that I need to upgrade the app...

As you stated, you only updated Magisk APPLICATION, not the Magisk itself

Magisk main window, doesn't it show you Update at the top?

And btw, what does it show for your version of Magisk, vs the version of Magisk app?

They should be the same - see my screenshot

If Magisk version is older, it will show you Update on the right, you should click on that Update and do eg Install Direct

Please read Installation documentation on Magisk Github to understand that what is Magisk app vs the Magisk itself

---

You could google for Install from unknown sources or for Install unknown apps to find how to enable (on A8+ it is disabled by default, for all apps)

Hopefully, your Intune does not block you from enabling. If it does, your adb workaround is nice

 

[vMAC]

As you stated, you only updated Magisk APPLICATION, not the Magisk itself

Magisk main window, doesn't it show you Update at the top?

And btw, what does it show for your version of Magisk, vs the version of Magisk app?

They should be the same - see my screenshot

If Magisk version is older, it will show you Update on the right, you should click on that Update and do eg Install Direct

Please read Installation documentation on Magisk Github to understand that what is Magisk app vs the Magisk itself

---

You could google for Install from unknown sources or for Install unknown apps to find how to enable (on A8+ it is disabled by default, for all apps)

Hopefully, your Intune does not block you from enabling. If it does, your adb workaround is nice

Yes my company's Intune blocks installing from unknown sources even on my personal side.

I downloaded the latest version of Canary from the Github........That is what I installed via adb install magisk.apk, and this is what shows in my magisk:

 

[zgfg]

Yes my company's Intune blocks installing from unknown sources even on my personal side.

I downloaded the latest version of Canary from the Github........That is what I installed via adb install magisk.apk, and this is what shows in my magisk:

View attachment 5647573

Please look at your screenshot. It shows everything - please read

Your installed app is v25001 but it shows that latest is v25101

If you are blocked from Installing from unknown sources, go to Magisk GitHub and download Canary APK 25101 (not stable 25001) and install by adb

Or, if you already downloaded Canary 25101 and attempted to install by adb, then check if adb installing reported you an error (due to Intune?!)- that could be also the reason why you still have Magisk app 25001, not 25101

Also, your Magisk app is hidden. For many reasons it is better to unhide before updating. If Install from unknown sources blocks you to unhide, then uninstall the old Magisk app and then install the new 25101

Again, Magisk app (former mngr) is not Magisk itself. Uninstalling Magisk app will not uninstall Magisk itself (but you have to uninstall the app, like any app - and not through adb, bcs it will only disable the old app package but will leave it present on the system)

 

[traversone]

Lsposed released new Shamiko *.115 !!

https://github.com/LSPosed/LSPosed.github.io/releases

 

[huskydg]

Lsposed released new Shamiko *.115 !!

https://github.com/LSPosed/LSPosed.github.io/releases

LSPosed released new Shamiko which fixed Found zygisk for latest Momo but the banking apps that won't run with zygisk enabled like Livin by Madiri still not open.

Magisk Delta

Delta custom Magisk fork is discontinued Please use Official Magisk. Good bye 👋👋👋

t.me

Releases · LSPosed/LSPosed.github.io

Contribute to LSPosed/LSPosed.github.io development by creating an account on GitHub.

github.com

 

[traversone]

LSPosed released new Shamiko which fixed Found zygisk for latest Momo but the banking apps that won't run with zygisk enabled like Livin by Madiri still not open.

Releases · LSPosed/LSPosed.github.io

Contribute to LSPosed/LSPosed.github.io development by creating an account on GitHub.

github.com

...ItsMe unfortunately still detects root

 

[huskydg]

...ItsMe unfortunately still detects root

Shamiko only hide "found zygisk" for Momo 4.3.1, it cannot comepletely hide

 

[pndwal]

Lsposed released new Shamiko *.115 !!

https://github.com/LSPosed/LSPosed.github.io/releases

Latest Shamiko Changelog

### 0.5.1
- Support Magisk 25+

Nb. Rikka has removed Shana's note stating "Some modules like "storage-isolation-enhanced" will reveal the existence of Zygisk", since release, so seems she's fixed issue in her Storage Isolation app enhancement...
Update shamiko_changelog.md
RikkaW committed 2 hours ago

PW

 

[huskydg]

Rikka has removed Shana's note stating "Some modules like "storage-isolation-enhanced" will reveal the existence of Zygisk", since release, so seems she's fixed issue in her Storage Isolation app enhancement... PW

Shamiko already cannot hide zygisk

 

[Stillhard]

Latest Shamiko Changelog

### 0.5.1
- Support Magisk 25+

Nb. Rikka has removed Shana's note stating "Some modules like "storage-isolation-enhanced" will reveal the existence of Zygisk", since release, so seems she's fixed issue in her Storage Isolation app enhancement...
Update shamiko_changelog.md
RikkaW committed 2 hours ago

PW

'The girls squad' attacked Rikka too now?

Some modules like

Go go power Rikka

Ponkles love Riru

 

[pndwal]

@pndwal how to inspect is it 2SI device

Not sure how to test, but basic rule is Any launched with Android 10+ and Legacy ramdisk devices updated to/running Android 10+ and Pixel 3/3a series devices. Those launched with Legacy SAR (generally Android 9), apart from Pixel 3/3a series which were "retrofitted" by Google and the exception, are "stuck" as Legacy SAR boot type devices... PW