MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0

[bombadier]

Am looking for some help trying to work out what method my banking app is using to detect root, up until I updated the app yesterday everything was working great with this banking app, Play integrity API Checker reports a tick for Device and basic integrity but a cross for Strong which if I understand right is to be expected, I have a Pixel 4a running Android 13.
I have the Magisk app hidden, am using Shamiko to hide, had to use props config to spoof an andoid 10 fingerprint to get Basic integrity and the banking app is in the deny list, everything has been set up correctly and Google Wallet and Netflix are still working, the bank app was working until the update, as of version 104.03 it detects root.
Now the MOMO checker says my environment is abnormal, found executable file "su", found files modified by Magisk Module and it found Magisk, also debugging is enabled and an unlocked bootloader, I am struggling to find much about MOMO or how to deal with what its reporting, ie how to hide Magisk better from MOMO.
I know its not really relevant for this thread as I am passing safetynet but I know there are plenty knowledgeable sorts that frequent this thread that know a lot more on the subject as I, anybody got any ideas for me to try ?
Thanks in advance,

 

[73sydney]

Am looking for some help trying to work out what method my banking app is using to detect root, up until I updated the app yesterday everything was working great with this banking app, Play integrity API Checker reports a tick for Device and basic integrity but a cross for Strong which if I understand right is to be expected, I have a Pixel 4a running Android 13.
I have the Magisk app hidden, am using Shamiko to hide, had to use props config to spoof an andoid 10 fingerprint to get Basic integrity and the banking app is in the deny list, everything has been set up correctly and Google Wallet and Netflix are still working, the bank app was working until the update, as of version 104.03 it detects root.
Now the MOMO checker says my environment is abnormal, found executable file "su", found files modified by Magisk Module and it found Magisk, also debugging is enabled and an unlocked bootloader, I am struggling to find much about MOMO or how to deal with what its reporting, ie how to hide Magisk better from MOMO.
I know its not really relevant for this thread as I am passing safetynet but I know there are plenty knowledgeable sorts that frequent this thread that know a lot more on the subject as I, anybody got any ideas for me to try ?
Thanks in advance,

Step 1: Disable MagiskHide Props Config

Step 2: Install Universal SafetyNet Fix (mod 2):

Releases · Displax/safetynet-fix

Google SafetyNet attestation workarounds for Magisk - Displax/safetynet-fix

github.com

Step 3: Reboot

Step 4: Test

And also check with this (over Momo):

Releases · byxiaorun/Ruru

An android sample app of detecting suspicious apps like magisk manager - byxiaorun/Ruru

github.com

 

[bombadier]

Step 1: Disable MagiskHide Props Config

Step 2: Install Universal SafetyNet Fix (mod 2):

Releases · Displax/safetynet-fix

Google SafetyNet attestation workarounds for Magisk - Displax/safetynet-fix

github.com

Step 3: Reboot

Step 4: Test

And also check with this (over Momo):

Releases · byxiaorun/Ruru

An android sample app of detecting suspicious apps like magisk manager - byxiaorun/Ruru

github.com

Thanks for the suggestions, have done as you said, Ruru is still detecting magisk and su and the banking app is also still detecting I am rooted, this was a fresh install of the banking app and adding it to the deny list before running for the first time, any ideas how I can better hide magisk and su ? got a feeling the banking app is checking for an unlocked bootloader, with the modded safetynet fix, wallet and netflix is still working, still failing Strong integrity but the fingerprint now matches the release keys, both are android 13 as when I rebooted there was a system update, something play related which I assume is to do with the fingerprint

 

[73sydney]

Thanks for the suggestions, have done as you said, Ruru is still detecting magisk and su and the banking app is also still detecting I am rooted, this was a fresh install of the banking app and adding it to the deny list before running for the first time, any ideas how I can better hide magisk and su ? got a feeling the banking app is checking for an unlocked bootloader, with the modded safetynet fix, wallet and netflix is still working, still failing Strong integrity but the fingerprint now matches the release keys, both are android 13 as when I rebooted there was a system update, something play related which I assume is to do with the fingerprint

My Ruru detects Su, Busybox, Magisk, and have developer options enabled and unlocked bootloader but my banking apps still work fine...so its not impossible for most banking apps

Have you:

Force closed and cleared data for your bankign app at any point during this?...worth a try

Ever used TWRP on that device?

Which banking app, so i can test?

p.s. as for the update yes, when you change your fingerprint you can find yourself missing updates....and you definitely want to stay on your proper fingerprint where possible to get things like monthly security patches...

 

[zgfg]

My Ruru detects Su, Busybox, Magisk, and have developer options enabled and unlocked bootloader but my banking apps still work fine...so its not impossible for most banking apps

Have you:

Force closed and cleared data for your bankign app at any point during this?...worth a try

Ever used TWRP on that device?

Which banking app, so i can test?

p.s. as for the update yes, when you change your fingerprint you can find yourself missing updates....and you definitely want to stay on your proper fingerprint where possible to get things like monthly security patches...

Using Denylist and HMA, and Ruru does not detect anything

 

[73sydney]

Using Denylist and HMA, and Ruru does not detect anything

No one like a bragger @zgfg

If the kiddie has no luck, ill send him your way

 

[bombadier]

My Ruru detects Su, Busybox, Magisk, and have developer options enabled and unlocked bootloader but my banking apps still work fine...so its not impossible for most banking apps

Have you:

Force closed and cleared data for your bankign app at any point during this?...worth a try

Ever used TWRP on that device?

Which banking app, so i can test?

p.s. as for the update yes, when you change your fingerprint you can find yourself missing updates....and you definitely want to stay on your proper fingerprint where possible to get things like monthly security patches...

Only thing is the Halifax Banking app needs an account as it lets you put the username and password in before it fails, have tried using the Adaway DNS logging and there is no unusual outgoing requests( I know the lloyds banking app seems to need some things blocked to work)
Never used TWRP and I know to check for things like that, tried disabling usb debugging but no difference,
I had uninstalled the banking app so no local data, installed it fresh after rebooting my phone and added it to the deny list before opening, this latest update mentions in the changelog something about security updates, as I said google wallet and Netflix are both still working so its something with the app,
yeah me changing the fingerprint was only meant to be a short term thing, at least the fingerprint is fixed cheers

 

[73sydney]

Only thing is the Halifax Banking app needs an account as it lets you put the username and password in before it fails, have tried using the Adaway DNS logging and there is no unusual outgoing requests( I know the lloyds banking app seems to need some things blocked to work)
Never used TWRP and I know to check for things like that, tried disabling usb debugging but no difference,
I had uninstalled the banking app so no local data, installed it fresh after rebooting my phone and added it to the deny list before opening, this latest update mentions in the changelog something about security updates, as I said google wallet and Netflix are both still working so its something with the app,
yeah me changing the fingerprint was only meant to be a short term thing, at least the fingerprint is fixed cheers

Needing a username and password before failing is new, and makes it impossible to test here

 

[bombadier]

Needing a username and password before failing is new, and makes it impossible to test here

Thanks anyways after seeing the previous comments about HMA I found your write up about using it might give that a go ........

 

[73sydney]

Thanks anyways after seeing the previous comments about HMA I found your write up about using it might give that a go ........

worth a crack, otherwise you might want to give Magisk Delta a go

@zgfg will guide you if needed, smugly

 

[bombadier]

worth a crack, otherwise you might want to give Magisk Delta a go

@zgfg will guide you if needed, smugly

Magisk delta might be the way to go. HMA has too many moving parts if you know what I mean, other as Magisk Delta's page any other good resources to check out ? I struggle with Telegram, seems to be too much nonsense floating about

 

[73sydney]

Magisk delta might be the way to go. HMA has too many moving parts if you know what I mean, other as Magisk Delta's page any other good resources to check out ? I struggle with Telegram, seems to be too much nonsense floating about

HMA is easier to setup than it used to be (you used ot have to rtemember to hit a Save icon on each step, which of course most people failed all the time)

If you change to Delta, remember to disable Shamiko, if youre going to enable Zygisk mode in Delta, you can use the same USNF module or you can use HuskyDG's own Riru/Zygisk version here that covers both options:

Release Safetynet Fix v2.3.1 MOD 2 (Riru/Zygisk) · HuskyDG/safetynet-integrity-fix

A workarround to pass SafetyNet / Play Integrity API on rooted devices with unlocked bootloader - Release Safetynet Fix v2.3.1 MOD 2 (Riru/Zygisk) · HuskyDG/safetynet-integrity-fix

github.com

 

[zgfg]

Magisk delta might be the way to go. HMA has too many moving parts if you know what I mean, other as Magisk Delta's page any other good resources to check out ? I struggle with Telegram, seems to be too much nonsense floating about

I pass Ruru both with Delta and official Magisk, hence Delta not needed for

 

[bombadier]

I pass Ruru both with Delta and official Magisk, hence Delta not needed for

Aye so are you using official magisk with HMA or Delta with the updated built in hide functions ? so whats the best way for me to go ? or are you saying you pass with official magisk and nothing extra running ?

 

[bombadier]

HMA has managed to hide root from the Halifax app

 

[varunpilankar]

You may be missing the point of this module.

It's simply to allow you to pass PI deviceIntegrity when you don't!... If you already pass, updating won't help you further (except that it does help OnePlus and some other device users with other issues however, but I believe only if running A12+ w/ official USNF which combination can break fingerprint scanners etc; the @Displax mod builds some updated fixes for these devices/issues connected with spoofing props), and in your case running A10, it may not be needed at all as many devices pass PI deviceIntegrity w/ A10 or less and official USNF...

To put it simply, if you weren't passing deviceIntegrity before installing, then the @Displax USNF mod/fork is doing its job perfectly... There are simply other detected traces of root or apps, folders or other signals associated with custom modding that are being detected by your app and need addressing...

The basics are:
- Zygisk = Yes on Magisk home screen.
- (Bank/other) app in denylist. (Enforce DenyList enabled.)
- PI deviceIntegrity passing.
- Full Magisk App replaced with hidden stub App

Next things to try:
- Shamiko module. (Enforce DenyList disabled.)
- LSPosed module and configure Hide My Applist Xposed module properly.
- Check for and remove/rename folders associated with TWRP etc.
- Run detection apps like Momo to determine what else may be detected on your device...

Nb. Clear app's data after any detection/failure and before any new test...

Hope it helps. PW

Thank you for your brief explanation and support. Really appreciate it.

Most of the points were covered already by me. Finally I tried lsposed - hide my applist with its proper configuration.

Finally it's worked!

I have tested it this weekend with 5+ payments using Paytm Tap to pay.

Just to keep a notes of while using lsposed hide my applist. It started breaking my app license for couple of apps like Tasker, Kustom apps, etc which mainly has root access and were added into the list. I fixed that issue by removing them from the list (fingers crossed, for not breaking them again) while keeping take tap to pay working.

 

[Arealhooman]

Thank you for your brief explanation and support. Really appreciate it.

Most of the points were covered already by me. Finally I tried lsposed - hide my applist with its proper configuration.

Finally it's worked!

I have tested it this weekend with 5+ payments using Paytm Tap to pay.

Just to keep a notes of while using lsposed hide my applist. It started breaking my app license for couple of apps like Tasker, Kustom apps, etc which mainly has root access and were added into the list. I fixed that issue by removing them from the list (fingers crossed, for not breaking them again) while keeping take tap to pay working.

I tried hide my app list on android 13 and I almost got a boot loo (triggered boot loop protection)

 

[pndwal]

I tried hide my app list on android 13 and I almost got a boot loo (triggered boot loop protection)

Not sure why you're posting this here; there's an HMA thread on XDA now. (Nb. It's a lot of fun too, if you like cats, smartwatches and other unrelated stuff! )... But since it may benefit users here:

For A13 you need HMA 3.x... Some of us have been using 3.x beta... The first stable build, 3.0.6, arrived just 9 hrs ago:
https://github.com/Dr-TSNG/Hide-My-Applist/releases

... If you are using 3.x already, you may not have read release notes... It does pay to... Note this:
3. No longer need the Magisk module, make sure to uninstall it, or you will bootloop

Hope this does it... PW

 

[73sydney]

Not sure why you're posting this here; there's an HMA thread on XDA now. (Nb. It's a lot of fun too, if you like cats, smartwatches and other unrelated stuff! )... But since it may benefit users here:

While i thank you for upselling my HMA thread, the bear is upset that you didnt mention him.....unlike me he's a known attention seeker....

It will be a miracle if he doesnt insist i post that pic of him over on the thread before the night is out....

And this is ALL your fault...

 

[locolyric]

Any one have idea how to make this ewallet run ? I try all hide my app and magisk delta. And It won't work.