[MODULE] InitRcHider

Search This thread

mrspeccy

Senior Member
Dec 19, 2016
119
140
Copenhagen
Several banking and security apps discover system modifications that Magisk injects through the init.rc file. These modifications can be successfully hidden with MomoHider (https://github.com/canyie/Riru-MomoHider), however, that module requires the Riru framework, which is incompatible with the upcoming Zygisk version of Magisk (e.g. Canary 23015). Therefore, I made a module that exclusively runs the init.rc hiding code from MomoHider without requiring Riru. See the attached file.

Just flash the module through the Magisk app. There are no configuration options. If the module is active, the init.rc hiding code is run.

I use the module to hide my custom Android ROM and Magisk from a recent app developed by the Danish Agency for Digitisation.
 

Attachments

  • InitRcHider.zip
    3.2 KB · Views: 1,517
  • LICENSE.txt
    880 bytes · Views: 182
Last edited:

dohanin

Senior Member
Several banking and security apps discover system modifications that Magisk injects through the init.rc file. These modifications can be successfully hidden with MomoHider (https://github.com/canyie/Riru-MomoHider), however, that module requires the Riru framework, which is incompatible with the upcoming Zygisk version of Magisk (e.g. Canary 23015). Therefore, I made a module that exclusively runs the init.rc hiding code from MomoHider without requiring Riru. See the attached file.

Just flash the module through the Magisk app. There are no configuration options. If the module is active, the init.rc hiding code is run.

I use the module to hide my custom Android ROM and Magisk from a recent app developed by the Danish Agency for Digitisation.
Thanks a lot. I have been searching for a while since I moved to use Zygisk and finally found this post.

However, do you know if there is any reliable detector about init.rc hiding? I've been using MagiskDetector. While it correctly showed that init.rc was not modified after installing your module, after a day or two it would suddenly report modified init.rc. I've read posts saying MagiskDetector is not accurate as it sometimes reports this even if magisk is not installed. I just want to make sure init.rc has been correctly hidden. Thanks.
 

mrspeccy

Senior Member
Dec 19, 2016
119
140
Copenhagen
You're welcome. My module just runs the same code as riru-momohider for hiding init.rc modficiations. The sudden detection you mention may be a false positive of MagiskDetector. Since I installed the module (under Magisk Zygisk) the security app that checks for init.rc modifications never reported "root found" again. I do not know of any other detectors for init.rc modifications.
 

dohanin

Senior Member
You're welcome. My module just runs the same code as riru-momohider for hiding init.rc modficiations. The sudden detection you mention may be a false positive of MagiskDetector. Since I installed the module (under Magisk Zygisk) the security app that checks for init.rc modifications never reported "root found" again. I do not know of any other detectors for init.rc modifications.
I see. Thanks for your reply.
 

dohanin

Senior Member
Hi, I begin to think it is not a false positive from MagiskDetector when it shows init.rc is modified by Magisk. Because the work profile in my phone has very strong root detection logic, and I just now it detected root and wiped out my work profile automatically :(

While other bank apps, root checkers, and even Momo could not detect at that moment, MagiskDetector did report init.rc modified.

I saved the logs from MagiskDetector when 1) it did not report init.rc modified and 2) it reported init.rc modified and compared the details. What I found is that there is a line in the log from 2) which is not there in 1) :
svc name init.svc.mdnsd

Any idea what this service is and is it supposed to be hidden by InitRcHider?
 

m0han

Senior Member
Apr 30, 2012
4,799
1,889
....The sudden detection you mention may be a false positive of MagiskDetector.......I do not know of any other detectors for init.rc modifications.

....I begin to think it is not a false positive from MagiskDetector when it shows init.rc is modified by Magisk....What I found is that there is a line in the log from 2) which is not there in 1): svc name init.svc.mdnsd...
i installed the module. it didn't work on reboot. i mean, MagiskDetector app reported 'modified'. i then cleared cache and data for MagiskDetector and ran the app; it asked me to 'reboot and try', which i did. now, it says 'not modified'. thanks!
 

Attachments

  • Screenshot_20220117-081236_RootBeer_Sample.png
    Screenshot_20220117-081236_RootBeer_Sample.png
    149.5 KB · Views: 271
  • Screenshot_20220117-081156_Applist_Detector.png
    Screenshot_20220117-081156_Applist_Detector.png
    135.5 KB · Views: 285
  • Screenshot_20220117-081217_Magisk_Detector.png
    Screenshot_20220117-081217_Magisk_Detector.png
    113.1 KB · Views: 262
  • Screenshot_20220117-081256_YASNAC.png
    Screenshot_20220117-081256_YASNAC.png
    146 KB · Views: 278

Eng.Raman

Senior Member
Apr 13, 2014
462
549
Khanaqin
Several banking and security apps discover system modifications that Magisk injects through the init.rc file. These modifications can be successfully hidden with MomoHider (https://github.com/canyie/Riru-MomoHider), however, that module requires the Riru framework, which is incompatible with the upcoming Zygisk version of Magisk (e.g. Canary 23015). Therefore, I made a module that exclusively runs the init.rc hiding code from MomoHider without requiring Riru. See the attached file.

Just flash the module through the Magisk app. There are no configuration options. If the module is active, the init.rc hiding code is run.

I use the module to hide my custom Android ROM and Magisk from a recent app developed by the Danish Agency for Digitisation.
It works, thanks. (y)
 

dohanin

Senior Member
yes, clearing data and cache of MagiskDetector sometimes work, but sometimes I had to re-install initrchider module in Magisk as well.

still puzzled on why after it worked, after a day or two, MagiskDetector would suddenly report Init.rc modified, without me changing anything or even reboot
 

pndwal

Senior Member
yes, clearing data and cache of MagiskDetector sometimes work, but sometimes I had to re-install initrchider module in Magisk as well.

still puzzled on why after it worked, after a day or two, MagiskDetector would suddenly report Init.rc modified, without me changing anything or even reboot
Apparently does this without magisk even installed which is why canyie commented that test in MagiskDetector is broken... When asked by @osm0sis if will be fixed vvb2060 said MD is deprecated / he she is working on Momo now... PW
 
Last edited:
  • Like
Reactions: dohanin and osm0sis

huskydg

Senior Member
Feb 17, 2021
51
15
Several banking and security apps discover system modifications that Magisk injects through the init.rc file. These modifications can be successfully hidden with MomoHider (https://github.com/canyie/Riru-MomoHider), however, that module requires the Riru framework, which is incompatible with the upcoming Zygisk version of Magisk (e.g. Canary 23015). Therefore, I made a module that exclusively runs the init.rc hiding code from MomoHider without requiring Riru. See the attached file.

Just flash the module through the Magisk app. There are no configuration options. If the module is active, the init.rc hiding code is run.

I use the module to hide my custom Android ROM and Magisk from a recent app developed by the Danish Agency for Digitisation.
On Android 11+, there maybe also init.svc_debug_pid.******

need resetprop --delete init.svc_debug_pid.$1
 

Spartacus500

Senior Member
Nov 6, 2014
613
115
This module does not work on Samsung Galaxy S7 edge Custom Pie 9.0 Rom, module active and magisk detector app and momo app shows nothing hidden 😔
 
  • Like
Reactions: originalul

Spartacus500

Senior Member
Nov 6, 2014
613
115
Magisk detector shows once hidden init.rc and over time shows modified. The most reliable application detecting system modifications is MOMO 4.0.1 APP, it always shows if init.rc is modified, and if not it does not.
 

z1022

Senior Member
Feb 2, 2012
463
33
Magisk detector shows once hidden init.rc and over time shows modified. The most reliable application detecting system modifications is MOMO 4.0.1 APP, it always shows if init.rc is modified, and if not it does not.
I use MOMO 4.0.1 APP, it shows init.rc is modified. How can I fix it ? If I have already used Shamiko and InitRChider.
 

huskydg

Senior Member
Feb 17, 2021
51
15
Just ignore because detect init.rc not always correct. I don't use initrc hider but momo don't detect it
 

newbit

Senior Member
Nov 16, 2008
200
73
Several banking and security apps discover system modifications that Magisk injects through the init.rc file. These modifications can be successfully hidden with MomoHider (https://github.com/canyie/Riru-MomoHider), however, that module requires the Riru framework, which is incompatible with the upcoming Zygisk version of Magisk (e.g. Canary 23015). Therefore, I made a module that exclusively runs the init.rc hiding code from MomoHider without requiring Riru. See the attached file.

Just flash the module through the Magisk app. There are no configuration options. If the module is active, the init.rc hiding code is run.

I use the module to hide my custom Android ROM and Magisk from a recent app developed by the Danish Agency for Digitisation.
Hi @mrspeccy,
is your module source somewhere public? The Module is not working on my Device (AL10 Oreo 8.0.0) so I would like to look into it. Also it seems to be a good starting point for another Module Project. Injecting custom *.rc and fstab files without editing the ramdisk image.
Cheers
NewBit
 

Top Liked Posts

  • There are no posts matching your filters.
  • 18
    Several banking and security apps discover system modifications that Magisk injects through the init.rc file. These modifications can be successfully hidden with MomoHider (https://github.com/canyie/Riru-MomoHider), however, that module requires the Riru framework, which is incompatible with the upcoming Zygisk version of Magisk (e.g. Canary 23015). Therefore, I made a module that exclusively runs the init.rc hiding code from MomoHider without requiring Riru. See the attached file.

    Just flash the module through the Magisk app. There are no configuration options. If the module is active, the init.rc hiding code is run.

    I use the module to hide my custom Android ROM and Magisk from a recent app developed by the Danish Agency for Digitisation.
    3
    Several banking and security apps discover system modifications that Magisk injects through the init.rc file. These modifications can be successfully hidden with MomoHider (https://github.com/canyie/Riru-MomoHider), however, that module requires the Riru framework, which is incompatible with the upcoming Zygisk version of Magisk (e.g. Canary 23015). Therefore, I made a module that exclusively runs the init.rc hiding code from MomoHider without requiring Riru. See the attached file.

    Just flash the module through the Magisk app. There are no configuration options. If the module is active, the init.rc hiding code is run.

    I use the module to hide my custom Android ROM and Magisk from a recent app developed by the Danish Agency for Digitisation.
    On Android 11+, there maybe also init.svc_debug_pid.******

    need resetprop --delete init.svc_debug_pid.$1
    2
    yes, clearing data and cache of MagiskDetector sometimes work, but sometimes I had to re-install initrchider module in Magisk as well.

    still puzzled on why after it worked, after a day or two, MagiskDetector would suddenly report Init.rc modified, without me changing anything or even reboot
    Apparently does this without magisk even installed which is why canyie commented that test in MagiskDetector is broken... When asked by @osm0sis if will be fixed vvb2060 said MD is deprecated / he she is working on Momo now... PW
    1
    This module does not work on Samsung Galaxy S7 edge Custom Pie 9.0 Rom, module active and magisk detector app and momo app shows nothing hidden 😔
    1
    Ah ok, thanks. So you didn't mod the actually Zygisk C++ Code from the Riru-MomoHider Module?
    Did you mean 'mod the Ruru C++ code' here?

    MomoHider never worked w/ Zygisk. It was depreciated probably before Rikka's Ruru (core) was, and Canyie's new 'root' hider is Shamiko for embedded Zygisk framework.

    Of course this now integrates Canyies own reworked init.rc hiding but is closed source. 👀 PW