[MODULE] InitRcHider

[mrspeccy]

Several banking and security apps discover system modifications that Magisk injects through the init.rc file. These modifications can be successfully hidden with MomoHider (https://github.com/canyie/Riru-MomoHider), however, that module requires the Riru framework, which is incompatible with the upcoming Zygisk version of Magisk (e.g. Canary 23015). Therefore, I made a module that exclusively runs the init.rc hiding code from MomoHider without requiring Riru. See the attached file.

Just flash the module through the Magisk app. There are no configuration options. If the module is active, the init.rc hiding code is run.

I use the module to hide my custom Android ROM and Magisk from a recent app developed by the Danish Agency for Digitisation.

 

[dohanin]

Several banking and security apps discover system modifications that Magisk injects through the init.rc file. These modifications can be successfully hidden with MomoHider (https://github.com/canyie/Riru-MomoHider), however, that module requires the Riru framework, which is incompatible with the upcoming Zygisk version of Magisk (e.g. Canary 23015). Therefore, I made a module that exclusively runs the init.rc hiding code from MomoHider without requiring Riru. See the attached file.

Just flash the module through the Magisk app. There are no configuration options. If the module is active, the init.rc hiding code is run.

I use the module to hide my custom Android ROM and Magisk from a recent app developed by the Danish Agency for Digitisation.

Thanks a lot. I have been searching for a while since I moved to use Zygisk and finally found this post.

However, do you know if there is any reliable detector about init.rc hiding? I've been using MagiskDetector. While it correctly showed that init.rc was not modified after installing your module, after a day or two it would suddenly report modified init.rc. I've read posts saying MagiskDetector is not accurate as it sometimes reports this even if magisk is not installed. I just want to make sure init.rc has been correctly hidden. Thanks.

 

[mrspeccy]

You're welcome. My module just runs the same code as riru-momohider for hiding init.rc modficiations. The sudden detection you mention may be a false positive of MagiskDetector. Since I installed the module (under Magisk Zygisk) the security app that checks for init.rc modifications never reported "root found" again. I do not know of any other detectors for init.rc modifications.

 

[dohanin]

You're welcome. My module just runs the same code as riru-momohider for hiding init.rc modficiations. The sudden detection you mention may be a false positive of MagiskDetector. Since I installed the module (under Magisk Zygisk) the security app that checks for init.rc modifications never reported "root found" again. I do not know of any other detectors for init.rc modifications.

I see. Thanks for your reply.

 

[dohanin]

Hi, I begin to think it is not a false positive from MagiskDetector when it shows init.rc is modified by Magisk. Because the work profile in my phone has very strong root detection logic, and I just now it detected root and wiped out my work profile automatically

While other bank apps, root checkers, and even Momo could not detect at that moment, MagiskDetector did report init.rc modified.

I saved the logs from MagiskDetector when 1) it did not report init.rc modified and 2) it reported init.rc modified and compared the details. What I found is that there is a line in the log from 2) which is not there in 1) :
svc name init.svc.mdnsd

Any idea what this service is and is it supposed to be hidden by InitRcHider?

 

[m0han]

....The sudden detection you mention may be a false positive of MagiskDetector.......I do not know of any other detectors for init.rc modifications.

....I begin to think it is not a false positive from MagiskDetector when it shows init.rc is modified by Magisk....What I found is that there is a line in the log from 2) which is not there in 1): svc name init.svc.mdnsd...

i installed the module. it didn't work on reboot. i mean, MagiskDetector app reported 'modified'. i then cleared cache and data for MagiskDetector and ran the app; it asked me to 'reboot and try', which i did. now, it says 'not modified'. thanks!

 

[Eng.Raman]

Several banking and security apps discover system modifications that Magisk injects through the init.rc file. These modifications can be successfully hidden with MomoHider (https://github.com/canyie/Riru-MomoHider), however, that module requires the Riru framework, which is incompatible with the upcoming Zygisk version of Magisk (e.g. Canary 23015). Therefore, I made a module that exclusively runs the init.rc hiding code from MomoHider without requiring Riru. See the attached file.

Just flash the module through the Magisk app. There are no configuration options. If the module is active, the init.rc hiding code is run.

I use the module to hide my custom Android ROM and Magisk from a recent app developed by the Danish Agency for Digitisation.

It works, thanks.

 

[dohanin]

yes, clearing data and cache of MagiskDetector sometimes work, but sometimes I had to re-install initrchider module in Magisk as well.

still puzzled on why after it worked, after a day or two, MagiskDetector would suddenly report Init.rc modified, without me changing anything or even reboot

 

[pndwal]

yes, clearing data and cache of MagiskDetector sometimes work, but sometimes I had to re-install initrchider module in Magisk as well.

still puzzled on why after it worked, after a day or two, MagiskDetector would suddenly report Init.rc modified, without me changing anything or even reboot

Apparently does this without magisk even installed which is why canyie commented that test in MagiskDetector is broken... When asked by @osm0sis if will be fixed vvb2060 said MD is deprecated / he she is working on Momo now... PW

 

[huskydg]

Several banking and security apps discover system modifications that Magisk injects through the init.rc file. These modifications can be successfully hidden with MomoHider (https://github.com/canyie/Riru-MomoHider), however, that module requires the Riru framework, which is incompatible with the upcoming Zygisk version of Magisk (e.g. Canary 23015). Therefore, I made a module that exclusively runs the init.rc hiding code from MomoHider without requiring Riru. See the attached file.

Just flash the module through the Magisk app. There are no configuration options. If the module is active, the init.rc hiding code is run.

I use the module to hide my custom Android ROM and Magisk from a recent app developed by the Danish Agency for Digitisation.

On Android 11+, there maybe also init.svc_debug_pid.******

need resetprop --delete init.svc_debug_pid.$1

 

[Spartacus500]

Work this Samsung Android 8.0, 9.0 Pie ?

 

[Spartacus500]

This module does not work on Samsung Galaxy S7 edge Custom Pie 9.0 Rom, module active and magisk detector app and momo app shows nothing hidden

 

[huskydg]

Zygisk - Shamiko lastest version now includes hiding init

 

[z1022]

Zygisk - Shamiko lastest version now includes hiding init

Magisk Detector Test still show "init.rc has been modified by Magisk". Any configue.

 

[huskydg]

Magisk Detector Test still show "init.rc has been modified by Magisk". Any configue.

Detect modified init.rc is not always correct, so i think nearly there are no app detect it

 

[Spartacus500]

Magisk detector shows once hidden init.rc and over time shows modified. The most reliable application detecting system modifications is MOMO 4.0.1 APP, it always shows if init.rc is modified, and if not it does not.

 

[z1022]

Magisk detector shows once hidden init.rc and over time shows modified. The most reliable application detecting system modifications is MOMO 4.0.1 APP, it always shows if init.rc is modified, and if not it does not.

I use MOMO 4.0.1 APP, it shows init.rc is modified. How can I fix it ? If I have already used Shamiko and InitRChider.

 

[Spartacus500]

I use MOMO 4.0.1 APP, it shows init.rc is modified. How can I fix it ? If I have already used Shamiko and InitRChider.

What phone model do you have ? I have Samsung Galaxy S7 edge 9.0 Pie and on Shamiko module it doesn't hide init.rc.

 

[huskydg]

Just ignore because detect init.rc not always correct. I don't use initrc hider but momo don't detect it

 

[newbit]

Several banking and security apps discover system modifications that Magisk injects through the init.rc file. These modifications can be successfully hidden with MomoHider (https://github.com/canyie/Riru-MomoHider), however, that module requires the Riru framework, which is incompatible with the upcoming Zygisk version of Magisk (e.g. Canary 23015). Therefore, I made a module that exclusively runs the init.rc hiding code from MomoHider without requiring Riru. See the attached file.

Just flash the module through the Magisk app. There are no configuration options. If the module is active, the init.rc hiding code is run.

I use the module to hide my custom Android ROM and Magisk from a recent app developed by the Danish Agency for Digitisation.

Hi @mrspeccy,
is your module source somewhere public? The Module is not working on my Device (AL10 Oreo 8.0.0) so I would like to look into it. Also it seems to be a good starting point for another Module Project. Injecting custom *.rc and fstab files without editing the ramdisk image.
Cheers
NewBit