Magisk General Support / Discussion

[osm0sis]

No haven't seen that one yet, but you could experiment by adding one with Magisk and see if anything respects it.

 

[zgfg]

No haven't seen that one yet, but you could experiment by adding one with Magisk and see if anything respects it.

I did test on my two Xiaomi phones, MIUI 12.5/A11 and MIUI 13/A12

None of them had the /etc/nsswitch.conf file, or anything similar

I created the conf file as zipped and attached (XDA does not allow conf extension attachments) and copied the conf file to:
/data/adb/modules/hosts/system/etc

After reboot, the conf file was mounted to /etc (as 'required')

Initially, the conf file defines:
hosts: files dns

Then I tested the opposite (both options are prepared in the same conf file, one must be commented out, the other un-commented):
hosts: dns files

and rebooted - but the conf file seems to be ignored, /etc/hosts file has always the precedence over DNS (ads are always blocked for me via the hosts file)

PS: Maybe if somebody with A13 (latest Pixel update) would like to test

 

[ctcx]

It's ok not to be a dev or know Python, you can use the program as a user,
it would extract the boot from the image, transfer it to the phone, create the script based on the chosen file, create the patch and pull it back to your PC, and it is cross platform.
You can inspect the generated script which is bash, and understand what it is doing without necessarily knowing one bit of python.
The program is very verbose so that people can follow what is going on.

Generate a patch using the program, and let's assume this patch is not exactly what is needed and functional, let's call it a bad patch

Also generate a patch the manual way that you know works, and let's call this a good patch
Next you would compare the two, the patched boot files can be unpacked and compared.

This can be done on the phone or if you are more comfortable doing it on the PC, you can use the excellent toolkit Android Image Kitchen by @osm0sis
Even a binary diff would give you an idea of the difference.
See further below.


I don't agree with the above generalization, there's always outliers, but in general the community is very helpful, and amazingly patient even with newcomers, what is typically not tolerated is people not putting in the effort to research or even read few posts and expect all the answers to be delivered on a platter.
When a senior member who is well seasoned and knows what he/she is talking about, asks a specific question to be able to offer advise, and it is evaded, it naturally irks the person.
Almost always there is a lot of context in the questioner's mind that is not totally relayed in the post, hence why specific questions are asked and answers expected.


You're not supposed to know, but you find out with exploratory observation, testing, trial and error and of course differential analysis.
For example I didn't know about the KEEPVERITY and KEEPENFORCEENCRYPT flags when I first called boot_patch.sh, and just like you the generated patch was not good and different from a good patch.
I did a binary diff of the two (at the time I didn't even know I could unpack) and noticed those two keywords existing in the good patch, but not mine.
Read up about it, inspected the script, and asked questions to eventually figure out the right options to use to generate an identical patch.
Same with the Magisk32,

Thanks again for your whole advice.

However, still nothing of this would explain my first problem back here:

Magisk General Support / Discussion

This is the place for general support and discussion regarding "Public Releases", which includes both stable and beta releases. All information, including troubleshoot guides and notes, are in the Announcement Thread

forum.xda-developers.com

 

[Elsrougy]

Is there anyway to tell if an app is checking for strong integrity? I have 2 apps that stopped working after having to update them and it's because they detect root, but I would like to know if it's strong integrity so I can just give up. The apps names are Absher and Nafath.

Did you get any answer? Absher, Nafath & SNB (Bank) all not working now

 

[olik2000]

Did you get any answer? Absher, Nafath & SNB (Bank) all not working now

Yeah same for me

 

[Nergal di Cuthah]

Did you get any answer? Absher, Nafath & SNB (Bank) all not working now

Yeah same for me

That was from a while ago (many magisk canaries). So lets start with basics.
What device
What android version
What other mods do you have
What version of magisk (canary stable beta and number)
What version of usnf are you running
What's in your deny list

All of that will make finding what is being seen by the apps easier . It is HIGHLY UNLIKLY that it is belching on strong integrity nobody to date uses that one, and if, by slight chance they are -which they're not - then the only remedy is to unroot and relock your bootloader and turn off oem debug.

 

[pndwal]

Finally installed Magisk on an ocean (Moto) device with LOS 20.0. With Zygisk active, universal safetynet module, and adding the infamous banking app to deny list, app finally let run instead of complaining "device cannot be trusted, exit".

But there were big problems, which I describe in 2 separate posts.

First, trying "fastboot boot magisk_patched.img" did not work at all.
Fastboot output:
fastboot FAILED (remote: '') # yes, [B]nothing[/B] inside the simple quotes...
Bootloader logs:
incomplete boot image downloaded

I tried with su in PC console, "--set-active=b" just to be sure (albeit it's always slot b, and it already was), different platform-tools versions... NOTHING.

Why is this?

Fastboot temp booting images doesn't work on all devices... Did you try flashing? PW

 

[badabing2003]

However, still nothing of this would explain my first problem back here:

Magisk General Support / Discussion

This is the place for general support and discussion regarding "Public Releases", which includes both stable and beta releases. All information, including troubleshoot guides and notes, are in the Announcement Thread

forum.xda-developers.com

My answer has not changed
Inspect the boot file you generated and see how it differs from the expected patched boot file.

incomplete boot image downloaded
This should be a clue.

 

[pndwal]

Is there anyway to tell if an app is checking for strong integrity? I have 2 apps that stopped working after having to update them and it's because they detect root, but I would like to know if it's strong integrity so I can just give up. The apps names are Absher and Nafath.

Did you get any answer? Absher, Nafath & SNB (Bank) all not working now

Check app prerequisites and see if it can run with Android 7 or earlier... If it can they're not enforcing strongIntegrity...

Test if app can run on any unmodded (stock, locked) device launched with Android 7 or earlier (can be running later stock Android) or any later device known to have broken keymaster implementation (eg. many OnePlus devices)... If it can they're not enforcing strongIntegrity...

Nb. It is conceivable that an app requiring strongIntegrity might not check for this on certain (whitelisted) devices. However if this behaviour did exist the App would really be compromising the strongIntegrity attestation itself since there should be no way to bypass a failing verdict... Implementing such behaviour would allow any device to bypass the verdict simply by spoofing the device properties of any whitelisted device, rendering strongIntegrity really no better than deviceIntegrity...

PW

 

[olik2000]

That was from a while ago (many magisk canaries). So lets start with basics.
What device
What android version
What other mods do you have
What version of magisk (canary stable beta and number)
What version of usnf are you running
What's in your deny list

All of that will make finding what is being seen by the apps easier . It is HIGHLY UNLIKLY that it is belching on strong integrity nobody to date uses that one, and if, by slight chance they are -which they're not - then the only remedy is to unroot and relock your bootloader and turn off oem debug.

Moto edge 30 ultra
Android 12
I have magisk alpha 25210 + latest lsposed
I have shamiko and all apps that don't require root added to denylist + google services and store
I use unsf 2.4.0 mod 1.1
I also have hide my applist
snb used to work but stopped after a recent update

 

[Nergal di Cuthah]

Moto edge 30 ultra
Android 12
I have magisk alpha 25210 + latest lsposed
I have shamiko and all apps that don't require root added to denylist + google services and store
I use unsf 2.4.0 mod 1.1
I also have hide my applist
snb used to work but stopped after a recent update

Magisk 25210 is flawed, no mods are enabled or can run. Switch to 25209 or stable. Don't forget to roll back your boot.img too.
Usnf mod 1.1 was flawed did not kick in soon enough switch to 2.4.0 mod 1.2

Then try and see if apps still are blocked

 

[zgfg]

Magisk 25210 is flawed, no mods are enabled or can run. Switch to 25209 or stable. Don't forget to roll back your boot.img too.
Usnf mod 1.1 was flawed did not kick in soon enough switch to 2.4.0 mod 1.2

Then try and see if apps still are blocked

He mentioned Magisk Alpha 25210..Not sure do we have active Alpha users who know the up-to-date situation there, bugs and fixes in the recent Alpha releases, etc

 

[Nergal di Cuthah]

He mentioned Magisk Alpha 25210..Not sure do we have active Alpha users who know the up-to-date situation there, bugs and fixes in the recent Alpha releases, etc

Oops i read alpha as canary and forgot that there are forks (poorly named imho) alpha and delta. Figured since this is the general thread they were using the general magisk, at my likely mistake.

 

[ctcx]

My answer has not changed
Inspect the boot file you generated and see how it differs from the expected patched boot file.

incomplete boot image downloaded
This should be a clue.

Probably you forgot that I did mention that I tried with ALL the imgs: the bad patch, the good one, and even the original unpatched one. All of them gave that result.

 

[badabing2003]

Probably you forgot that I did mention that I tried with ALL the imgs: the bad patch, the good one, and even the original unpatched one. All of them gave that result.

Yes, I didn't realize that, so basically what you're saying you have a flashing issue, no matter what you try to flash, it does not work, even stock?

Then what @pndwal suggested is the most plausible reason.

 

[Elsrougy]

That was from a while ago (many magisk canaries). So lets start with basics.
What device
What android version
What other mods do you have
What version of magisk (canary stable beta and number)
What version of usnf are you running
What's in your deny list

All of that will make finding what is being seen by the apps easier . It is HIGHLY UNLIKLY that it is belching on strong integrity nobody to date uses that one, and if, by slight chance they are -which they're not - then the only remedy is to unroot and relock your bootloader and turn off oem debug.

-Device: OnePlus 8 Pro
-Android Version: stock OOS 11
-Other mods: for magisk modules I disabled them all and tried but no luck, also using HMA (in the log it doesn't seem they check tho) and shamiko (tried with & without)
- Magisk version: stable 25200
- USNF: 1.2 (I tried Kdrag0n & Displax mod 1.2
- Deny list: play services, store, Android service library, android setup, device health survices, support component, package installer and a bunch of apps that need root hidden to work. I know I added a lot of unecessary apps to the list but I did that when I got fedup with those apps before

I don't believe they are checking for strong integrity but it seems like there's nothing working with them right now. Worth noting that few months ago they had an update and they were not working with denylist and shamiko fixed the problem. Also from play store info absher supports (android 5.0 and up), while SNB & Nafath supports 8.0 and up

 

[Elsrougy]

Check app prerequisites and see if it can run with Android 7 or earlier... If it can they're not enforcing strongIntegrity...

Test if app can run on any unmodded (stock, locked) device launched with Android 7 or earlier (can be running later stock Android) or any later device known to have broken keymaster implementation (eg. many OnePlus devices)... If it can they're not enforcing strongIntegrity...

Nb. It is conceivable that an app requiring strongIntegrity might not check for this on certain (whitelisted) devices. However if this behaviour did exist the App would really be compromising the strongIntegrity attestation itself since there should be no way to bypass a failing verdict... Implementing such behaviour would allow any device to bypass the verdict simply by spoofing the device properties of any whitelisted device, rendering strongIntegrity really no better than deviceIntegrity...

PW

From play store info "absher" supports (android 5.0 and up), while "SNB" & "Nafath" supports 8.0 and up
I know it is highly unlikely that they are checking for strong integrity but because I tried alot to make them work with no luck I am starting to think of the extreme cases they may use
I do not have a device running android 7 or earlier to check on them unfortunately but my device is oneplus 8 pro stock OOS11

 

[pndwal]

Yes, I didn't realize that, so basically what you're saying you have a flashing issue, no matter what you try to flash, it does not work, even stock?

Then what @pndwal suggested is the most plausible reason.

Praps not a flashing issue... Not sure if flashing was actually tried... I said:

Fastboot temp booting images doesn't work on all devices... Did you try flashing? PW

Probably you forgot that I did mention that I tried with ALL the imgs: the bad patch, the good one, and even the original unpatched one. All of them gave that result.

... Sorry, I only saw the reference to temp booting magisk-patched image also, per:

Finally installed Magisk on an ocean (Moto) device with LOS 20.0. With Zygisk active, universal safetynet module, and adding the infamous banking app to deny list, app finally let run instead of complaining "device cannot be trusted, exit".

But there were big problems, which I describe in 2 separate posts.

First, trying "fastboot boot magisk_patched.img" did not work at all.
Fastboot output:
fastboot FAILED (remote: '') # yes, [B]nothing[/B] inside the simple quotes...
Bootloader logs:
incomplete boot image downloaded

I tried with su in PC console, "--set-active=b" just to be sure (albeit it's always slot b, and it already was), different platform-tools versions... NOTHING.

Why is this?

... If by "I tried with ALL the imgs: the bad patch, the good one, and even the original unpatched one. All of them gave that result" you mean with fastboot boot xxx.img then you should try flashing... PW

 

[dd805bb]

Magisk Alpha is maintained by one of the devs for lsposed and contributes to Magisk Official. The Alpha Canary is the same as the Canary Official, FYI.

 

[ctcx]

With Magisk installed, in order to make banking app work I had to:
enable Zygisk, install universal safetynet fix module, and also enable deny list and add banking app to it (I thought this last one was no longer needed...)

Infamous banking app finally ran and began registration stuff. But the app is unable to scan the needed qr code: the "screen" is just complete black instead of the camera looking for qr code.

Do you think this could be related to Magisk further settings, or is it purely app's fault?

Thanks.

(I read that, supposedly, there were 3rd-party qr code apps which were able to scan the qr code and open it with another installed app, which supposedly could work for cases like this. Do you know something about this?)